# ldap-rp

Proxy LDAP requests to different LDAP servers based on base DN. Based on code from [kanidm/ldap-proxy](https://github.com/kanidm/ldap-proxy/) under the [MPL license](LICENSE.md).

## Features

- [x] No TLS setup ; use only in trusted networks
- [x] LDAP bind requests
- [x] LDAP search requests
- [x] Configurable listening port
- [ ] Default fallback to `/etc/ldap-rp/config.toml`
- [x] Unix Domain Socket support (incoming requests)
- [ ] Unix Domain Socket garbage collection (incoming requests)
- [ ] Unix Domain Socket support (outgoing requests)
- [ ] **not planned:** TLS termination (incoming requests)
- [ ] **not planned:** TLS backend connections (outgoing requests)
- [ ] **not planned:** TLS SNI passthrough

## Running

Create a configuration file `config.toml` with the following:

```toml
# Where to listen to incoming connections ([::1]:389 by default, requires privileges)
#  - ip/port: `127.0.0.1:3389` (ipv4 only on localhost) `[::1]:3389` (ipv4/ipv6 on localhost),
#             `0.0.0.0:3389` (ipv4 only on all interfaces, `[::]:3389` (ipv4/ipv6 on any interface)
#  - socket: `./ldap.sock` for a socket in the current working directory
#            `/var/run/ldap.sock` for a socket with an absolute path
listen = "[::]:3389"
[[mapping]]
from = "a.localhost"
to = "example.com"
backend = "127.0.0.1:4389"
[[mapping]]
from = "b.localhost"
to = "example.com"
backend = "127.0.0.1:5389"
```

~~By default, `ldap-rp` will look for a config file in `/etc/ldap-rp/config.toml` but you can change that
with the `--config` CLI flag.~~

You can now run:

```
ldap-rp --config config.toml
```

# Testing your setup

Once you have a LDAP server running, you can test your settings with the `ldapwhoami` command from the openldap package:

```bash
# Test when listening on port 3389
ldapwhoami -H ldap://localhost:3389 -D "cn=b,ou=people,dc=a,dc=localhost" -W
# Test when listening on socket /run/ldap-rp/ldap-rp.sock, where `/` is escaped
# with `%2F` and the protocol is changed to `ldapi`
ldapwhoami -H ldapi://%2Frun%2Fldap-rp%2Fldap-rp.sock -D "cn=b,ou=people,dc=a,dc=localhost" -W
```