Struct LdapAuthPlugin 

pub struct LdapAuthPlugin {
    base_dn: String,
    ldap_uri: String,
    uid: String,
    use_tls: bool,
    tls_verify: bool,
    realm: Template,
    timeout: Duration,
}

Authenticates HTTP Basic credentials against an LDAP server via simple bind.

Fields

base_dn: String

Base DN the bind DN is built under (e.g. ou=users,dc=example,dc=org).

ldap_uri: String

LDAP server URI (ldap://host:389 or ldaps://host:636).

uid: String

RDN attribute for the bind DN (APISIX uid, default cn).

use_tls: bool

When true, negotiate StartTLS on the connection.

tls_verify: bool

When false, TLS certificate verification is disabled.

realm: Template

Realm advertised in the WWW-Authenticate challenge. Supports {{namespace.path}} references (no legacy $var interpolation — realm never supported it, so this sweep must not start).

timeout: Duration

Whole-operation deadline for the connect + bind.

Implementations

impl LdapAuthPlugin

pub fn from_config( config: &HashMap<String, Value>, _resources: &Arc<PluginResources>, ) -> Result<Self, String>

Builds the plugin from node config.

Accepted keys:

• base_dn (string, required): base DN the bind DN is built under.
• ldap_uri (string, required): LDAP server URI, e.g. ldap://ldap.example.org:389.
• uid (string, default "cn"): RDN attribute prefixing the username in the bind DN.
• use_tls (bool, default false): negotiate StartTLS after connecting.
• tls_verify (bool, default false): verify the server certificate.
• realm (string, default "ldap"): realm in the challenge header; supports {{namespace.path}} references.
• timeout_ms (u64, default 10000): connect + bind deadline.

type: ldap-auth
config:
  base_dn: ou=users,dc=example,dc=org
  ldap_uri: ldap://ldap.example.org:389
  uid: cn
  use_tls: false
  tls_verify: false

fn reject( &self, ctx: Context, message: &str, ) -> Result<PluginOutput, PluginExecutionError>

Builds the 401 rejection carrying the WWW-Authenticate: Basic challenge and exits on the node’s denied port. Reserved for deliberate credential rejections — a missing/malformed header, empty credentials, or a bind the server actively refused.

fn infra_error( &self, ctx: Context, message: String, ) -> Result<PluginOutput, PluginExecutionError>

Builds a genuine infrastructure-failure Err (LDAP unreachable, or the connect+bind operation timed out) — unlike reject, this exits through the error port because the node could not do its job, not because a presented credential was deliberately refused. The prepared response is the shared 502 provider_error shape: no Basic challenge, so a browser does not re-prompt for a password that was never checked.

async fn bind(&self, dn: &str, password: &str) -> Result<bool, String>

Attempts a simple bind with dn/password against the LDAP server. Returns Ok(true) on a successful bind, Ok(false) on rejected credentials, and Err on a connection/transport error.

Trait Implementations

impl Plugin for LdapAuthPlugin

fn plugin_type(&self) -> &str

Unique identifier for the plugin type (e.g., “proxy-rewrite”, “upstream”). This is also the key its PortSpec is registered under in port_spec.

fn execute<'life0, 'async_trait>( &'life0 self, ctx: Context, ) -> Pin<Box<dyn Future<Output = Result<PluginOutput, PluginExecutionError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait,

Executes the plugin logic against the request/response context.

fn reads_response_body(&self) -> bool

Whether this configured instance reads context.response.body.

fn cache_target(&self) -> Option<CacheTarget>

The cache backend this node writes to, if it is a proxy-cache half.