Module ldap_auth 

LDAP Basic-auth plugin (ldap-auth).

Authenticates the request’s HTTP Basic credentials against an LDAP server by performing a simple bind with the user’s DN and the presented password. Port of APISIX’s ldap-auth plugin (the bind-authentication core of it).

Flow (matching apisix/plugins/ldap-auth.lua):

1. Parse the Authorization: Basic <base64(user:pass)> header.
2. Assemble the bind DN as <uid>=<username>,<base_dn>.
3. Connect to ldap_uri and attempt a simple bind with that DN + password.
4. Bind success → continue (context.message["user"] = username); a missing header, malformed credentials, or a bind failure → 401 LDAP_AUTH_FAILED with a WWW-Authenticate: Basic challenge.

This is bind-auth, not search-then-bind: the DN is built directly from uid/base_dn and no directory search is performed. See the Deviations in website/docs/reference/plugins/ldap-auth.md.

Structs

LdapAuthPlugin

Authenticates HTTP Basic credentials against an LDAP server via simple bind.

Functions

build_bind_dn 🔒

Assembles the bind DN as <uid>=<username>,<base_dn> (APISIX’s user_dn).

parse_basic_credentials 🔒

Parses an Authorization: Basic ... header value into (username, password).