Struct LdapProviderConfig 

pub struct LdapProviderConfig {
    pub url: String,
    pub bind_dn_template: String,
    pub starttls: bool,
    pub connection_timeout: Duration,
    pub group_search: Option<LdapGroupSearch>,
}

Available on crate feature ldap only.

Production LDAP provider wrapping the ldap3 crate.

TLS requirements

LDAP simple bind transmits passwords in the protocol data unit. Always use TLS to protect credentials on the wire:

• Preferred: ldaps:// URLs (TLS from the first byte, port 636).
• Alternative: ldap:// with .with_starttls() (upgrades to TLS after connect, port 389).

Certificate validation uses the system CA trust store (via rustls). For private CAs (common in enterprise AD deployments), install the CA certificate in the OS trust store or use the SSL_CERT_FILE / SSL_CERT_DIR environment variables.

Plain ldap:// without STARTTLS sends credentials in cleartext and must not be used outside localhost development.

Fields

url: String

LDAP server URL (e.g. "ldap://ad.example.com:389" or "ldaps://ad.example.com:636").

bind_dn_template: String

Template for constructing the bind DN from the user identifier. {user} is replaced with the login identifier.

Active Directory: "{user}@corp.example.com" (UPN) or "CORP\\{user}" OpenLDAP: "uid={user},ou=people,dc=example,dc=com"

starttls: bool

Use STARTTLS on plain LDAP connections. Ignored for ldaps:// URLs.

connection_timeout: Duration

Connection timeout. Default: 5 seconds.

group_search: Option<LdapGroupSearch>

Optional group membership search after successful bind.

Implementations

impl LdapProviderConfig

pub fn new( url: impl Into<String>, bind_dn_template: impl Into<String>, ) -> LdapProviderConfig

Create a new LDAP provider configuration.

Arguments

• url: LDAP server URL (ldap:// or ldaps://)
• bind_dn_template: template with {user} placeholder

pub fn with_starttls(self) -> LdapProviderConfig

Enable STARTTLS on plain LDAP connections.

pub fn with_timeout(self, timeout: Duration) -> LdapProviderConfig

Set the connection timeout.

pub fn with_group_search(self, search: LdapGroupSearch) -> LdapProviderConfig

Configure group membership search after successful bind.

Trait Implementations

impl HealthCheck for LdapProviderConfig

fn check(&self) -> Pin<Box<dyn Future<Output = HealthStatus> + Send + '_>>

Probe the component and return its current health.

impl LdapProvider for LdapProviderConfig

fn verify_bind<'a>( &'a self, identifier: &'a str, bind_dn: &'a str, password: &'a str, ) -> Pin<Box<dyn Future<Output = Result<LdapBindResult, LdapError>> + Send + 'a>>

Attempt a simple bind with the given DN and password.

fn build_bind_dn(&self, identifier: &str) -> String

Construct the bind DN for a given user identifier.