blocks|key|4909647|text|我可以通过passport-ldapauth认证到AD。其中一个关键是要知道要使用与某些在线LDAP示例不同的服务器选项|type|unstyled|depth|inlineStyleRanges|entityRanges|data|4909648|searchBase:+'ou=Accounts,dc=mydomain,dc=com'
searchFilter:+'(sAMAccountName={{username}})'++//+{{username}}+comes+from+the+html+form.|code-block|syntax|javascript|4909649|您还需要知道是否需要ldap和TLS。(我没有)我花了大量的时间研究ldapjs.org。|4909650|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|K|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|L|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|M|8|@]|9|@]|A|$]]|$1|I|3|-4|5|6|7|N|8|@]|9|@]|A|$]]]|J|$]]

I was able to authenticate to AD via passport-ldapauth. 
One key was knowing to use server opts which are different than in some LDAP examples online

<pre><code>searchBase: 'ou=Accounts,dc=mydomain,dc=com'
searchFilter: '(sAMAccountName={{username}})' // {{username}} comes from the html form.
</code></pre>

You also need to know if you need ldaps and TLS or not. (I did not) I spent a good amount of time digging through ldapjs.org.

blocks|key|2796663|text|我不确定您的需求有多灵活，但我正在研究同一主题，偶然发现了Microsoft的一个使用AD+FS作为Oauth提供程序的特定解决方案|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2796664|https://msdn.microsoft.com/en-us/library/dn633593.aspx|offset|length|2796665|粗略的阅读显示，web客户端联系AD以获取JWT令牌，然后该令牌被发送到您的服务器，然后服务器向AD服务器验证该令牌。|2796666|需要将AD服务器配置为将您的服务器作为需要其身份服务的依赖方接受。|2796667|entityMap|0|LINK|mutability|MUTABLE|url^0|0|0|1I|0|0|0|0^^$0|@$1|2|3|4|5|6|7|Q|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|R|8|@]|9|@$D|S|E|T|1|U]]|A|$]]|$1|F|3|G|5|6|7|V|8|@]|9|@]|A|$]]|$1|H|3|I|5|6|7|W|8|@]|9|@]|A|$]]|$1|J|3|-4|5|6|7|X|8|@]|9|@]|A|$]]]|K|$L|$5|M|N|O|A|$P|C]]]]

I am not sure how flexible you are with your requirements, but I was researching the same subject and stumbled upon a specific solution from Microsoft that uses AD FS as an Oauth provider

<a href="https://msdn.microsoft.com/en-us/library/dn633593.aspx" rel="nofollow">https://msdn.microsoft.com/en-us/library/dn633593.aspx</a>

A superficial reading shows that a web client contacts AD to get a JWT token, then this token is sent to your server, which then authenticates the token with the AD server.

The AD server needs to be configured to accept your server as a relying party that needs its identity service.

blocks|key|2020478|text|微软为此发布了一个官方的库：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2020479|https://github.com/AzureAD/passport-azure-ad|offset|length|2020480|直接从npm添加到您的项目：|2020481|npm+install+passport-azure-ad|code-block|syntax|javascript|2020482|或用于OAuth2流的Auth0的passport-azure-ad-oauth2。|2020483|entityMap|0|LINK|mutability|MUTABLE|url|1|https://github.com/auth0/passport-azure-ad-oauth2^0|0|0|18|0|0|0|0|H|O|1|0^^$0|@$1|2|3|4|5|6|7|X|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|Y|8|@]|9|@$D|Z|E|10|1|11]]|A|$]]|$1|F|3|G|5|6|7|12|8|@]|9|@]|A|$]]|$1|H|3|I|5|J|7|13|8|@]|9|@]|A|$K|L]]|$1|M|3|N|5|6|7|14|8|@]|9|@$D|15|E|16|1|17]]|A|$]]|$1|O|3|-4|5|6|7|18|8|@]|9|@]|A|$]]]|P|$Q|$5|R|S|T|A|$U|C]]|V|$5|R|S|T|A|$U|W]]]]

Microsoft have released an official library for this:

<a href="https://github.com/AzureAD/passport-azure-ad" rel="nofollow">https://github.com/AzureAD/passport-azure-ad</a>

Add to your project from npm directly:

<pre><code>npm install passport-azure-ad
</code></pre>

Or Auth0's <a href="https://github.com/auth0/passport-azure-ad-oauth2" rel="nofollow">passport-azure-ad-oauth2</a> for OAuth2 flows.

blocks|key|4909748|text|虽然这是一个老问题，但作为passport-ldapauth的维护者，我应该稍微澄清一下LDAP身份验证。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|4909749|LDAP身份验证与您以前使用的策略不同。这些OAuth策略实际上只能通过一种方式进行配置--提供所需的选项，然后它就会起作用。此部分与LDAP相同，但选项的实际值因服务器不同而不同。您所问的问题，如是否与sAMAccountName或uid匹配，实际上取决于您和LDAP服务器。|4909750|在RFC中已经广泛地定义了诸如DN看起来像什么、搜索库是什么、或者搜索过滤器的语法是什么之类的一般事情。如果不熟悉基础知识，就很难让身份验证正常工作。通常需要AD/LDAP服务器维护人员的输入来进行适当的设置，例如。什么搜索库允许查找所有需要的用户，但不会对LDAP服务器造成不必要的负载。|4909751|LDAP身份验证通常分三个步骤进行：|4909752|4909753|使用服务帐户(在passport-ldapauth、bindDn和bindCredentials中)，绑定到LDAP服务器。|ordered-list-item|4909754|绑定后，执行配置的搜索，将占位符替换为用户提供的用户名。这将确定是否从LDAP服务器中找到给定的用户名。|4909755|使用搜索结果的DN以及用户提供的密码，并绑定到LDAP服务器。这将验证密码。|4909756|4909757|如果你想让用户使用他们的SAMAccountName登录，你的搜索过滤器可以是例如。(sAMAccountName={{username}})。如果您希望用户使用uid，那么过滤器可以只使用(uid={{username}})。如果要同时启用这两个选项，请使用(%7C(sAMAccountName={{username}})(uid={{username}}))。搜索过滤器语法在RFC+4515中指定。|4909758|entityMap^0|D|H|0|0|0|0|0|8|H|Q|6|X|F|0|0|7|2|0|0|C|E|16|T|29|3|2N|I|3M|1E|0^^$0|@$1|2|3|4|5|6|7|Y|8|@$9|Z|A|10|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|11|8|@]|D|@]|E|$]]|$1|H|3|I|5|6|7|12|8|@]|D|@]|E|$]]|$1|J|3|K|5|6|7|13|8|@]|D|@]|E|$]]|$1|L|3|-4|5|6|7|14|8|@]|D|@]|E|$]]|$1|M|3|N|5|O|7|15|8|@$9|16|A|17|B|C]|$9|18|A|19|B|C]|$9|1A|A|1B|B|C]]|D|@]|E|$]]|$1|P|3|Q|5|O|7|1C|8|@]|D|@]|E|$]]|$1|R|3|S|5|O|7|1D|8|@$9|1E|A|1F|B|C]]|D|@]|E|$]]|$1|T|3|-4|5|6|7|1G|8|@]|D|@]|E|$]]|$1|U|3|V|5|6|7|1H|8|@$9|1I|A|1J|B|C]|$9|1K|A|1L|B|C]|$9|1M|A|1N|B|C]|$9|1O|A|1P|B|C]|$9|1Q|A|1R|B|C]]|D|@]|E|$]]|$1|W|3|-4|5|6|7|1S|8|@]|D|@]|E|$]]]|X|$]]

While this is an old question I thought, as the maintainer of <code>passport-ldapauth</code>, I should clarify LDAP authentication a little.

LDAP authentication is different from those strategies you've used before. Those OAuth strategies can really be configured only one way - provide the required options, and then it works. This part is the same with LDAP, but the actual values to the options differ from one server to the other. The questions you are asking, like do you match to sAMAccountName or uid, are really up to you and the LDAP server. 

General things like what does a DN look like, what is search base, or what is the syntax of search filter have been defined extensively in RFCs. If one is not familiar with the basics it can be difficult to get the authentication to work. Often the AD/LDAP server maintainer input is needed to have proper settings, eg. what search base allows finding all required users but does not cause unnecessary load on the LDAP server. 

LDAP authentication usually works in three steps:

<ol>
<li>Using a service account (in <code>passport-ldapauth</code>, <code>bindDn</code> and <code>bindCredentials</code>), bind against the LDAP server.</li>
<li>Once bound, perform the configured search substituting the placeholder with user provided username. This determines if the given username is found from the LDAP server.</li>
<li>Use the <code>DN</code> of the search result, together with user provided password, and bind against the LDAP server. This verifies the password.</li>
</ol>

If you wish to have users login using their <code>SAMAccountName</code>, your search filter could be eg. <code>(sAMAccountName={{username}})</code>. If you wish that the users use <code>uid</code>, the filter could be just <code>(uid={{username}})</code>. If you want to enable both, use <code>(|(sAMAccountName={{username}})(uid={{username}}))</code>. The search filter syntax is specified in RFC 4515.

blocks|key|4909778|text|我是一名顾问。我所在的公司只允许我有限地访问几台服务器。我没有登录ldap服务器的权限。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|4909779|我使用以下代码进行绑定：|4909780|(用户名{{sAMAccountName=}})|4909781|如果我无法物理登录到ldap服务器，我是否无法通过ldap进行身份验证？|4909782|如果他们给我登录服务器的权限，ldapauth就可以工作。|4909783|吉娜|4909784|entityMap^0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|N|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|O|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|P|8|@]|9|@]|A|$]]|$1|F|3|G|5|6|7|Q|8|@]|9|@]|A|$]]|$1|H|3|I|5|6|7|R|8|@]|9|@]|A|$]]|$1|J|3|K|5|6|7|S|8|@]|9|@]|A|$]]|$1|L|3|-4|5|6|7|T|8|@]|9|@]|A|$]]]|M|$]]

I am a consultant. The company that I am doing work for has given me limited access to a couple servers. I do not have permission to log on to the ldap server.

I am using the following to bind:

(sAMAccountName={{username}})

If I cannot physically log on to the ldap server am I not able to authenticate via ldap?

If they give me access to log on to the server, ldapauth works.

Gina

I have successfully assembled over a half dozen passport strategies (facebook, twitter, linkedin, instagram, tumblr, google, youtube) exchange account info with oauth1 and oauth2 token, into a single standalone auth server that saves session in Mongo and creates active profiles, with token/session/code/id fields and with many standardized atribute fields in SQL server using Tedious.js. These passport tools are excellent, thank you. 

My last challenge for this project is not going as well, username and password into an active directory repository, to look up and auth in the same way. I have been trying over and over again passport-ldap, passport-ldapauth (based on ldapauth-gfork, based on ldapjs), passport-windowsauth and passport-kerberos, and seem to be getting related credential errors (deep in code, adding console.logs to try and figure out what I am getting syntactically wrong).

Are there any other resources and documentation to accessing LDAP/AD in Node.js using any strategy of Passport? The DN versus ou syntax and where the account access user (have a service account specifically set up to access the AD) for the repository versus the account user you are looking up and the filters make it very difficult to find anything error related to figure out where I am going wrong. Do you match to sAMAccountName or uid? I keep consistently getting "unauthorized" errors.

Unlike the other 70 passport strategies, where the doc and examples are clear and just work, not so much for ad/ldap passport. Can anyone point me to a good test, doc or setup that works well specifically with Passport.js and Active Directory?

Passport Active Directory node.js

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

我已经成功地组装了超过六个passport策略(脸书，推特，领英，instagram，tumblr，谷歌，youtube)与oauth1和oauth2 token交换帐户信息，整合到一个独立的身份验证服务器中，该服务器在Mongo中保存会话并创建活动配置文件，具有token/ session /code/id字段和使用...

问Passport活动目录node.js
EN

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问Passport活动目录node.jsEN