selfhoster1312/ldap-rp
Watch
1
1
Fork
You've already forked ldap-rp
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: Search by mail attribute (stalwart compatibility)

Browse source
This commit is contained in:
selfhoster selfhoster 2026-08-28 12:03:23 +02:00
commit c746e594ca
4 changed files with 265 additions and 35 deletions
Download patch file Download diff file Expand all files Collapse all files

20
README.md
View file

@ -7,6 +7,12 @@ Proxy LDAP requests to different LDAP servers based on base DN. Based on code fr
- [x] No TLS setup ; use only in trusted networks
- [x] LDAP bind requests
- [x] LDAP search requests
- [x] extract requested backend from mail attribute filter
- [x] bind to requested backend with mapping `user` and `password` fields
- [ ] **not (yet?) planned:** extract requested backend from more filters
- [x] rewrite the search dn with backend `to` dn (eg. `ou=people,dc=a,dc=localhost` -> `ou=people,dc=example,dc=com`)
- [x] rewrite returned entries with backend dn (eg. `uid=a,ou=people,dc=example,dc=com` -> `uid=a,ou=people,dc=a,dc=localhost`)
- [ ] rewrite search dn and result entries for authenticated searches on a backend
- [x] Configurable listening port
- [ ] Default fallback to `/etc/ldap-rp/config.toml`
- [x] Unix Domain Socket support (incoming requests)
@ -35,10 +41,16 @@ to = "example.com"
# - start with anything else for a TCP connection
# backend = "/run/lldap/example.com.sock"
backend = "127.0.0.1:4389"
# Credentials for performing search query to the backend
# set `lldap_strict_readonly` perms on the account in lldap.
user = "stalwart"
password = "adminadmin"
[[mapping]]
from = "b.localhost"
to = "example.com"
backend = "127.0.0.1:5389"
user = "stalwart"
password = "adminadmin"
```
~~By default, `ldap-rp` will look for a config file in `/etc/ldap-rp/config.toml` but you can change that
@ -61,3 +73,11 @@ ldapwhoami -H ldap://localhost:3389 -D "cn=b,ou=people,dc=a,dc=localhost" -W
# with `%2F` and the protocol is changed to `ldapi`
ldapwhoami -H ldapi://%2Frun%2Fldap-rp%2Fldap-rp.sock -D "cn=b,ou=people,dc=a,dc=localhost" -W
```
You can also perform a search by email without binding with specific credentials, the base dn provided will have its hostname set to the backend mapping's `from` value:
```
ldapsearch -x -b "ou=people" -H "ldap://localhost:3389" -s sub "(mail=a@a.localhost)" uid mail
```
This is strictly equivalent to using `-b "ou=people,dc=a,dc=localhost"` because the search dn is always overwritten.