Kitto.Auth.LDAP

Defines the LDAP authenticator: it validates the supplied credentials by performing a simple bind against an LDAP directory (typically Active Directory), using the native Windows LDAP API (wldap32.dll). No local user table is needed: the directory itself confirms that the user exists and that the password is correct. After a successful bind, if a SearchBase is configured, the authenticator reads the user's display attributes (first name, last name, e-mail, and optionally the group membership) and stores them into the authentication data, so they are available through the %Auth:...% macros and to the access controller.

TKLDAPAuthenticator class

The LDAP authenticator requires the same auth items as its ancestor TKClassicAuthenticator (UserName + Password). It does NOT use a database table: the user is authenticated by a simple bind against an LDAP server (typically an Active Directory domain controller).

Users normally log in with the DOMAIN\UserName form. If a bare user name is supplied (no domain), the DefaultDomain parameter is prepended, so users can type just their user name. A UPN form (user@domain) is also accepted as-is.

Configuration parameters (children of the Auth node in Config.yaml):

• Host Host name or IP of the LDAP server (domain controller). Required.
• Port TCP port. Default 389 (plain) or 636 when UseSSL is True.
• UseSSL True to open an LDAPS (SSL) connection. Strongly recommended, because a plain simple bind sends the password in clear over the wire. Default False.
• DefaultDomain NetBIOS domain prepended to a bare user name (so jsmith becomes DOMAIN\jsmith at bind time). Optional but recommended. Ignored when BindDNTemplate is set.
• BindDNTemplate For a generic (non-AD) LDAP directory that binds by distinguished name: a template with a single %s placeholder for the (short) user name, e.g. uid=%s,dc=example,dc=com. When set, the user types only the short name (e.g. tesla) and it takes precedence over the AD DOMAIN\user / DefaultDomain handling.
• SearchBase Base DN used to look up the user's attributes after the bind, e.g. DC=corp,DC=local. If omitted, the bind still authenticates the user but no attribute is read.
• SearchFilter LDAP filter with a single %s placeholder for the sAMAccountName. Default (sAMAccountName=%s).
• Attributes/Email LDAP attribute mapped to EMAIL_ADDRESS. Default mail.
• Attributes/FirstName Default givenName (stored as FIRST_NAME).
• Attributes/LastName Default sn (stored as LAST_NAME).
• Attributes/FullName Default displayName (stored as FULL_NAME).
• Attributes/Groups Default memberOf (stored as MEMBER_OF, a ';'-separated list). Set to empty to skip.

function IsPasswordMatching(const ASuppliedPasswordHash: string;

Not used: the credential check is the LDAP bind itself, so hash matching never happens. Always returns False.

function SupportsPasswordChange: Boolean;

False: passwords live in the directory and must be changed there. Without this the base SetPassword — whose body is empty — would run and the change-password dialog would report success while writing nothing. Consistent with ResetPassword, which refuses explicitly.

procedure ResetPassword(const AParams: TEFNode);

Not supported: passwords are managed in the directory.

procedure QRGenerate(const AParams: TEFNode);

Not supported: PIN/QR authentication is not available for LDAP.