ldap-rp/README.md

# ldap-rp

Proxy LDAP requests to different LDAP servers based on base DN. Based on code from [kanidm/ldap-proxy](https://github.com/kanidm/ldap-proxy/) under the [MPL license](LICENSE.md).

## Features

- [x] No TLS setup ; use only in trusted networks
- [x] LDAP bind requests
- [x] LDAP search requests
  - [x] extract requested backend from mail attribute filter
  - [x] bind to requested backend with mapping `user` and `password` fields
  - [ ] **not (yet?) planned:** extract requested backend from more filters
  - [x] rewrite the search dn with backend `to` dn (eg. `ou=people,dc=a,dc=localhost` -> `ou=people,dc=example,dc=com`)
  - [x] rewrite returned entries with backend dn (eg. `uid=a,ou=people,dc=example,dc=com` -> `uid=a,ou=people,dc=a,dc=localhost`)
  - [ ] rewrite search dn and result entries for authenticated searches on a backend
- [x] Configurable listening port
- [ ] Default fallback to `/etc/ldap-rp/config.toml`
- [x] Unix Domain Socket support (incoming requests)
- [ ] Unix Domain Socket garbage collection (incoming requests)
- [x] Unix Domain Socket support (outgoing requests)
- [ ] **not planned:** TLS termination (incoming requests)
- [ ] **not planned:** TLS backend connections (outgoing requests)
- [ ] **not planned:** TLS SNI passthrough

## Running

Create a configuration file `config.toml` with the following:

```toml
# Where to listen to incoming connections ([::1]:389 by default, requires privileges)
#  - ip/port: `127.0.0.1:3389` (ipv4 only on localhost) `[::1]:3389` (ipv4/ipv6 on localhost),
#             `0.0.0.0:3389` (ipv4 only on all interfaces, `[::]:3389` (ipv4/ipv6 on any interface)
#  - socket: `./ldap.sock` for a socket in the current working directory
#            `/var/run/ldap.sock` for a socket with an absolute path
listen = "[::]:3389"
[[mapping]]
from = "a.localhost"
to = "example.com"
# The LDAP address of the backend server:
# - start with `./` or `/` for a socket URI
# - start with anything else for a TCP connection
# backend = "/run/lldap/example.com.sock"
backend = "127.0.0.1:4389"
# Credentials for performing search query to the backend
# set `lldap_strict_readonly` perms on the account in lldap.
user = "cn=stalwart,ou=people,dc=example,dc=com"
password = "adminadmin"
[[mapping]]
from = "b.localhost"
to = "example.com"
backend = "127.0.0.1:5389"
user = "cn=stalwart,ou=people,dc=example,dc=com"
password = "adminadmin"
```

~~By default, `ldap-rp` will look for a config file in `/etc/ldap-rp/config.toml` but you can change that
with the `--config` CLI flag.~~

You can now run:

```
ldap-rp --config config.toml
```

# Testing your setup

Once you have a LDAP server running, you can test your settings with the `ldapwhoami` command from the openldap package:

```bash
# Test when listening on port 3389
ldapwhoami -H ldap://localhost:3389 -D "cn=b,ou=people,dc=a,dc=localhost" -W
# Test when listening on socket /run/ldap-rp/ldap-rp.sock, where `/` is escaped
# with `%2F` and the protocol is changed to `ldapi`
ldapwhoami -H ldapi://%2Frun%2Fldap-rp%2Fldap-rp.sock -D "cn=b,ou=people,dc=a,dc=localhost" -W
```

You can also perform a search by email without binding with specific credentials, the base dn provided will have its hostname set to the backend mapping's `from` value:

```
ldapsearch -x -b "ou=people" -H "ldap://localhost:3389" -s sub "(mail=a@a.localhost)" uid mail
```

This is strictly equivalent to using `-b "ou=people,dc=a,dc=localhost"` because the search dn is always overwritten.