https://github.com/cityssm/node-activedirectory-authenticate
Just Active Directory authentication and nothing more!
https://github.com/cityssm/node-activedirectory-authenticate
active-directory activedirectory authentication ldap ldap-authentication ldap-client
Last synced: 6 months ago
JSON representation
Just Active Directory authentication and nothing more!
- Host: GitHub
- URL: https://github.com/cityssm/node-activedirectory-authenticate
- Owner: cityssm
- License: mit
- Created: 2025-07-07T18:46:58.000Z (11 months ago)
- Default Branch: master
- Last Pushed: 2025-10-20T05:39:18.000Z (8 months ago)
- Last Synced: 2025-10-21T08:47:41.066Z (8 months ago)
- Topics: active-directory, activedirectory, authentication, ldap, ldap-authentication, ldap-client
- Language: TypeScript
- Homepage: https://www.npmjs.com/package/@cityssm/activedirectory-authenticate
- Size: 992 KB
- Stars: 1
- Watchers: 0
- Forks: 0
- Open Issues: 5
-
Metadata Files:
- Readme: README.md
- Contributing: CONTRIBUTING.md
- License: LICENSE.md
- Code of conduct: CODE_OF_CONDUCT.md
- Security: SECURITY.md
Awesome Lists containing this project
README
# Active Directory Authenticate for Node
**Just Active Directory authentication and nothing more!**
[](https://www.npmjs.com/package/@cityssm/activedirectory-authenticate)
[](https://app.deepsource.com/gh/cityssm/node-activedirectory-authenticate/)
[](https://sonarcloud.io/summary/new_code?id=cityssm_node-activedirectory-authenticate)
Based on the work in the deprecated packages
[activedirectory2](https://www.npmjs.com/package/activedirectory2) and
[ldapjs](https://www.npmjs.com/package/ldapjs).
## Installation
```sh
npm install @cityssm/activedirectory-authenticate
```
## Usage
```javascript
import ActiveDirectoryAuthenticate from '@cityssm/activedirectory-authenticate'
const authenticator = new ActiveDirectoryAuthenticate(
{
url: 'ldap://example.com'
},
{
// The base distinguished name (DN) for the LDAP search.
baseDN: 'DC=example,DC=com',
// The DN of the user to bind to for searching the directory.
bindUserDN: 'CN=administrator,DC=example,DC=com',
bindUserPassword: 'p@ssword',
// Temporarily cache user bind DNs to reduce LDAP lookups on immediate retries,
// like typoed passwords.
cacheUserBindDNs: true
}
)
const loginResult = await authenticator.authenticate(
'example\\userName',
'pass123'
)
if (loginResult.success) {
// Credentials validated, log the user in!
} else {
console.log(loginResult.errorType)
// => "ACCOUNT_NOT_FOUND"
}
```
## Options
```javascript
import ActiveDirectoryAuthenticate from '@cityssm/activedirectory-authenticate'
const authenticator = new ActiveDirectoryAuthenticate(
ldapClientUrlOrOptions,
activeDirectoryAuthenticateOptions
)
```
### `ldapClientUrlOrOptions`
In most situations, passing an LDAP URL should be sufficient.
If additional configuration is required, like timeout adjustments and TLS settings,
see the available [ldapts](https://www.npmjs.com/package/ldapts) initialization options.
### `activeDirectoryAuthenticateOptions`
| Option | Description | Required |
| ------------------ | -------------------------------------------------------------------- | ---------------- |
| `baseDN` | The base distinguished name (DN) for the LDAP search. | ⭐ |
| `bindUserDN` | The DN for the user to bind to for searching the directory. | ⭐ |
| `bindUserPassword` | The password for the `bindUserDN`. | ⭐ |
| `cacheUserBindDNs` | Whether or not to temporarily cache user bind DNs, reducing lookups. | Default: `false` |
## Error Types
Active Directory Authenticate provides descriptive error types,
and translates the codes for common Active Directory errors.
See the `errorType` value in the result object.
| Error Type | Description | Active Directory Code |
| ----------------------- | --------------------------------------------- | --------------------- |
| `CONFIGURATION_ERROR` | Configuration error. | |
| `EMPTY_USER_NAME` | User name empty. | |
| `EMPTY_PASSWORD` | Password empty. | |
| `ACCOUNT_NOT_FOUND` | Unable to find the user via LDAP search. | |
| `LDAP_SEARCH_FAILED` | Unknown error searching LDAP for the user. | |
| `AUTHENTICATION_FAILED` | Unknown authentication error. | |
| `NO_SUCH_USER` | User not found. | `525` |
| `LOGON_FAILURE` | Invalid credentials. | `52e` |
| `INVALID_LOGIN_HOURS` | User not permitted to logon at current time. | `530` |
| `INVALID_WORKSTATION` | User not permitted to logon from workstation. | `531` |
| `PASSWORD_EXPIRED` | Password expired. | `532` |
| `ACCOUNT_DISABLED` | Account disabled. | `533` |
| `INVALID_LOGIN_TYPE` | User not granted the requested logon type. | `534` |
| `ACCOUNT_EXPIRED` | Account expired. | `701` |
| `PASSWORD_MUST_CHANGE` | User must reset password. | `773` |
| `ACCOUNT_LOCKED_OUT` | User account locked. | `775` |