Struct LdapConfig 

pub struct LdapConfig {
    pub host: String,
    pub port: u16,
    pub encryption: Encryption,
    pub verify_certificate: bool,
    pub allow_plaintext_password: bool,
    pub connect_timeout: Duration,
    pub timeout: Duration,
    pub max_message_size: usize,
}

Where the directory is and how much to insist on before talking to it.

Holds no credentials, which is why it can derive Debug: the bind DN and password live in crate::directory::Directory, which cannot.

Fields

host: String

port: u16

encryption: Encryption

verify_certificate: bool

Whether the server’s certificate has to chain to a trusted root and name the host. Off is for a laboratory and nowhere else.

allow_plaintext_password: bool

Whether a simple bind may go over an unencrypted connection.

False by default, and the error when it fires says why. A simple bind puts the password on the wire verbatim; this is the most common LDAP deployment mistake there is, and it is invisible from the outside because everything works.

connect_timeout: Duration

timeout: Duration

How long to wait for one response.

max_message_size: usize

The largest message this client will buffer.

Enforced from the length header, before anything is read, so a directory cannot make a client allocate by announcing a size it never sends.

Implementations

impl LdapConfig

pub fn parse(url: &str) -> Result<LdapConfig>

Parse ldap://host:port or ldaps://host:port.

ldaps:// implies port 636 and TLS from the first byte. ldap:// implies port 389 and, by default, StartTLS — because a URL is not a security decision and defaulting to the encrypted form of the same port is the version that fails loudly rather than leaking quietly. A caller who genuinely wants plain text asks with LdapConfig::plaintext.

pub fn plaintext(self) -> LdapConfig

Do not encrypt at all.

Separate from LdapConfig::allow_plaintext_password on purpose: this says “no TLS”, that one says “and send the password anyway”. A read-only anonymous search over plain TCP is a perfectly ordinary thing to do, and needs only the first.

pub fn start_tls(self) -> LdapConfig

pub fn ldaps(self) -> LdapConfig

pub fn port(self, port: u16) -> LdapConfig

pub fn allow_plaintext_password(self) -> LdapConfig

Send a simple bind even though the connection is not encrypted.

The named-in-full opt-in the security rule asks for. It exists because a test container on loopback is a real case; it should not appear in anything that talks to a directory over a network.

pub fn dangerously_accept_any_certificate(self) -> LdapConfig

Believe whatever certificate the directory presents.

This turns TLS into protection against a passive listener and nothing else: an active attacker simply presents a certificate of their own. The name is long because the call site is where somebody will read it.

pub fn timeout(self, timeout: Duration) -> LdapConfig

pub fn connect_timeout(self, timeout: Duration) -> LdapConfig

pub fn max_message_size(self, bytes: usize) -> LdapConfig

pub fn address(&self) -> String

Trait Implementations

impl Clone for LdapConfig

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for LdapConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.