Struct LdapAuthPlugin 

pub struct LdapAuthPlugin {
    base_dn: String,
    ldap_uri: String,
    uid: String,
    use_tls: bool,
    tls_verify: bool,
    realm: String,
    timeout: Duration,
}

Authenticates HTTP Basic credentials against an LDAP server via simple bind.

Fields

base_dn: String

Base DN the bind DN is built under (e.g. ou=users,dc=example,dc=org).

ldap_uri: String

LDAP server URI (ldap://host:389 or ldaps://host:636).

uid: String

RDN attribute for the bind DN (APISIX uid, default cn).

use_tls: bool

When true, negotiate StartTLS on the connection.

tls_verify: bool

When false, TLS certificate verification is disabled.

realm: String

Realm advertised in the WWW-Authenticate challenge.

timeout: Duration

Whole-operation deadline for the connect + bind.

Implementations

impl LdapAuthPlugin

pub fn from_config( config: &HashMap<String, Value>, _resources: &Arc<PluginResources>, ) -> Result<Self, String>

Builds the plugin from node config.

Accepted keys:

• base_dn (string, required): base DN the bind DN is built under.
• ldap_uri (string, required): LDAP server URI, e.g. ldap://ldap.example.org:389.
• uid (string, default "cn"): RDN attribute prefixing the username in the bind DN.
• use_tls (bool, default false): negotiate StartTLS after connecting.
• tls_verify (bool, default false): verify the server certificate.
• realm (string, default "ldap"): realm in the challenge header.
• timeout_ms (u64, default 10000): connect + bind deadline.

type: ldap-auth
config:
  base_dn: ou=users,dc=example,dc=org
  ldap_uri: ldap://ldap.example.org:389
  uid: cn
  use_tls: false
  tls_verify: false

fn reject( &self, ctx: Context, message: &str, ) -> Result<PluginOutput, PluginExecutionError>

Builds the 401 rejection carrying the WWW-Authenticate: Basic challenge and routes the context through the node’s error port.

async fn bind(&self, dn: &str, password: &str) -> Result<bool, String>

Attempts a simple bind with dn/password against the LDAP server. Returns Ok(true) on a successful bind, Ok(false) on rejected credentials, and Err on a connection/transport error.

Trait Implementations

impl Plugin for LdapAuthPlugin

fn plugin_type(&self) -> &str

Unique identifier for the plugin type (e.g., “proxy-rewrite”, “upstream”).

fn execute<'life0, 'life1, 'async_trait>( &'life0 self, ctx: Context, _named_inputs: &'life1 HashMap<String, Value>, ) -> Pin<Box<dyn Future<Output = Result<PluginOutput, PluginExecutionError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Executes the plugin logic against the request/response context.