Configuration for config.js (required)
- copy config.example and rename file to config.js. replace secret with a random generated secret. You can use for example https://randomkeygen.com/
Cofiguration for ad-config.js (required for Active Directory Authentication)
- copy ad-config.example and rename file to ad-config.js.
Options for the Active Directory configuration file
- path : path for login authentication, '/login' will setup a new http route at 'auth/ad/login' for authentication
- url : LDAP server url
- bindDN : Admin connection DN, e.g. uid=myapp,ou=users,dc=example,dc=org. Optional. If not given at all, admin client is not bound. Giving empty string may result in anonymous bind when allowed.
- bindCredentials : Password for bindDN
- searchBase : The base DN from which to search for users by username. E.g. ou=users,dc=example,dc=org
- searchFilter : LDAP search filter with which to find a user by username, group, e.g. '(&(sAMAccountName={{username}})(memberOf=CN=OSIV-Ivdat,OU=OSIV,DC=de,DC=ivnet,DC=ch))'. Use the literal {{username}} to have the given username interpolated in for the LDAP search.
errorMessages : Authentication possible error messages options
[errorMessages.badRequestMessage] - 'Missing credentials' - Message for missing username/password [errorMessages.invalidCredentials] - 'Invalid username/password' - Message for InvalidCredentialsError, NoSuchObjectError, and /no such user/ LDAP errors [errorMessages.userNotFound] - 'Invalid username/password' - Message for user not found [errorMessages.constraintViolation] - 'Exceeded password retry limit, account locked' - Message when account is locked (or other constraint violation) [errorMessages.invalidLogonHours] - 'Not Permitted to login at this time' - Message for Windows AD invalidLogonHours error [errorMessages.invalidWorkstation] - 'Not permited to logon at this workstation' - Message for Windows AD invalidWorkstation error [errorMessages.passwordExpired] - 'Password expired' - Message for Windows AD passwordExpired error [errorMessages.accountDisabled] - 'Account disabled' - Message for Windows AD accountDisabled error [errorMessages.accountExpired] - 'Account expired' - Message for Windows AD accountExpired error [errorMessages.passwordMustChange] - 'User must reset password' - Message for Windows AD passwordMustChange error [errorMessages.accountLockedOut] - 'User account locked' - Message for Windows AD accountLockedOut error [errorMessages.noSuchObject] - 'Bad search base' - Bad search base in LDAP query
More LDAP Query Examples for AD here