feat: add LDAP authentication module with JWT issuance #2074

mundele2004 · 2025-07-17T16:15:21Z

Pull Request Template

Description:

Added a plug-and-play LDAP authentication module under internal/auth/ldapauth.
The module performs Bind(username, password) authentication against an LDAP server and issues a JWT token upon successful login.
Addresses the LDAP Integration proposal for GoFr Framework Extension as per SOC.
Closes: issue LDAP Integration Helper Module #2014

Breaking Changes (if applicable):

None. This module is self-contained and does not interfere with any existing authentication mechanisms or routing middleware.

Additional Information:

External Library used: github.com/go-ldap/ldap/v3
JWT is issued using standard library packages (crypto/rand, encoding/base64) with HMAC SHA256 signing.
Unit tests include edge cases using a mock LDAP dialer function.
See mainFile/main.go for demo and testuser.ldif for testing against a local OpenLDAP instance.
Sample test user:

Summary

This PR introduces a standalone LDAP authentication module (internal/auth/ldapauth) for the GoFr framework. It uses Bind(username, password) to validate users and issues a JWT on successful login.

What's Included

ldapauth.go: Core logic for LDAP authentication and JWT issuance
ldapauth_test.go: Unit tests with mock LDAP dialer
main.go: Demo login flow using /login route
testuser.ldif: Sample LDAP user for testing

How to Test

Run local LDAP server (e.g., using Docker: osixia/openldap)

Load test user using testuser.ldif:

docker cp mainFile/testuser.ldif myldap:/testuser.ldif
docker exec -it myldap ldapadd -x -D "cn=admin,dc=example,dc=com" -w admin -f /testuser.ldif

Run the server:- go run mainFile/main.go
Test login:
curl -X POST http://localhost:8080/login
-H "Content-Type: application/json"
-d '{"username":"testuser", "password":"testpass"}'

Checklist:

I have formatted my code using goimport and golangci-lint.
All new code is covered by unit tests.
This PR does not decrease the overall code coverage.
I have reviewed the code comments and documentation for clarity.

Release/v1.42.3

gizmo-rt

Couple of Test cases to add

LDAP destination does not exists
. Bind request from an unauthorised user
Binding fail due to invalid username/pass
Binding Failure due to expired password
BindSuccess but info retrieval failed
App unable to generate JWT
Using an expired JWT

internal/auth/ldapauth/ldapauth.go

gizmo-rt · 2025-07-18T15:42:51Z

internal/auth/ldapauth/ldapauth.go

+
+func (a *Authenticator) Authenticate(username, password string) (string, error) {
+    // l, err := ldap.DialURL("ldap://" + a.cfg.Addr)
+    l, err := a.dialFn("ldap://" + a.cfg.Addr)


Could you elaborate on what l is ?

Also, was wondering what possible validations we could have for a.cfg.Addr ?

l is the LDAP connection (*ldap.Conn) returned by the dialer.

We should validate a.cfg.Addr for non-empty and proper host:port format using net.SplitHostPort.

internal/auth/ldapauth/ldapauth.go

gizmo-rt · 2025-07-18T15:47:02Z

internal/auth/ldapauth/ldapauth.go

+
+func New(cfg Config) *Authenticator {
+    return &Authenticator{
+        cfg: cfg,


Is the config specific to the LDAP library being used ?

The Config struct here is not directly from the go-ldap/ldap/v3 library — it's a custom wrapper defined within this module to keep the Authenticator decoupled from external configs.

This design allows flexibility — if we change or extend the backend (e.g. add StartTLS, change port or baseDN logic), we just update our config struct without impacting the rest of the app.

// Config holds LDAP server connection details and base search parameters.
// It is application-defined and not tied to the go-ldap library.

type Config struct { Addr string BaseDN string BindDN string BindPass string }

gizmo-rt · 2025-07-18T15:51:32Z

internal/auth/ldapauth/ldapauth.go

+    searchReq := ldap.NewSearchRequest(
+        a.cfg.BaseDN,
+        ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 0, false,
+        fmt.Sprintf("(uid=%s)", ldap.EscapeFilter(username)),
+        []string{"dn"},
+        nil,
+    )
+
+    sr, err := l.Search(searchReq)
+    if err != nil || len(sr.Entries) != 1 {
+        return "", fmt.Errorf("user not found")
+    }
+
+    userDN := sr.Entries[0].DN
+
+    if err := l.Bind(userDN, password); err != nil {
+        return "", fmt.Errorf("invalid credentials")
+    }
+
+    token := jwt.NewWithClaims(jwt.SigningMethodHS256, jwt.MapClaims{
+        "sub": username,
+        "exp": time.Now().Add(1 * time.Hour).Unix(),
+    })
+
+    signed, err := token.SignedString([]byte(a.cfg.JWTSecret))


This should preferably be decomposed into smaller, testable sections

internal/auth/ldapauth/ldapauth.go

…final testing

mundele2004 · 2025-07-21T12:54:22Z

Hi @gizmo-rt 👋
✅ All edge cases tested and working:

Valid login
Invalid password
Unknown user
LDAP unreachable

Updated main.go + test cases as requested.

@gizmo-rt I’ve added the requested edge case tests. Let me know if any further changes are needed. ✅

✅ Added all suggested edge case tests including:

LDAP server unreachable
Unauthorized bind
Invalid credentials
Expired password simulation
DN found but user info retrieval failed
JWT generation failure
Expired JWT handling

🧪 All tests pass locally.

PR is ready for review. Thanks!

mundele2004 · 2025-07-21T17:58:02Z

@Umang01-hash @coolwednesday Is there any way or command I could use to run Code Quality checks on my local machine in the same way they are executed in the pipeline?

Umang01-hash · 2025-07-24T05:55:26Z

@Umang01-hash @coolwednesday Is there any way or command I could use to run Code Quality checks on my local machine in the same way they are executed in the pipeline?

Hey @mundele2004! To run these code qaulity checks you can run golangci-lint run command on your local and see. Just make sure the linter version used in pipeline and the one installed on your system is same.

mundele2004 · 2025-07-30T19:18:37Z

✅ Resolved all golangci-lint issues and force-pushed updated changes.
All tests are passing locally. Awaiting review. 🚀
plz check @Umang01-hash

internal/auth/ldapauth/ldapauth.go

mundele2004 · 2025-08-01T18:23:43Z

Final PR after cleanup and linting. Ready for review 🚀
cc @akshat-kumar-singhal @Umang01-hash

mundele2004 · 2025-08-03T15:31:37Z

✅ Resolved all golangci-lint issues .
All tests are passing locally. . Ready for review 🚀
@akshat-kumar-singhal @Umang01-hash

akshat-kumar-singhal · 2025-08-04T06:30:11Z

✅ Resolved all golangci-lint issues . All tests are passing locally. . Ready for review 🚀 @akshat-kumar-singhal @Umang01-hash

@mundele2004 Please address all the feedback/comments on the PR - don't mark them resolved without a response/change.

mundele2004 · 2025-08-10T10:23:10Z

Please check — I have fixed the linter issues such as whitespace, cuddled statements, etc.
You also check and let me know. If there are still 2 gci issues, please tell me how I can solve them, because I have tried a lot but am unable to fix them. Kindly guide me.

**$ golangci-lint run
internal\auth\ldapauth\ldapauth.go:7:1: File is not properly formatted (gci)
"github.com/go-ldap/ldap/v3"
^
internal\auth\ldapauth\ldapauth_test.go:7:1: File is not properly formatted (gci)
"github.com/go-ldap/ldap/v3"
^
2 issues:

gci: 2**

@akshat-kumar-singhal @Umang01-hash

Umang01-hash · 2025-08-12T06:02:58Z

Please check — I have fixed the linter issues such as whitespace, cuddled statements, etc. You also check and let me know. If there are still 2 gci issues, please tell me how I can solve them, because I have tried a lot but am unable to fix them. Kindly guide me.

**$ golangci-lint run internal\auth\ldapauth\ldapauth.go:7:1: File is not properly formatted (gci) "github.com/go-ldap/ldap/v3" ^ internal\auth\ldapauth\ldapauth_test.go:7:1: File is not properly formatted (gci) "github.com/go-ldap/ldap/v3" ^ 2 issues:

gci: 2**

@akshat-kumar-singhal @Umang01-hash

@mundele2004 You can fix gci import order issues by installing and running the gci tool.

go install github.com/daixiang0/gci@latest

and then use gci write . inside the directory ldapauth. It should fix these errors.

mundele2004 · 2025-08-12T10:48:33Z

Please check — I have fixed the linter issues such as whitespace, cuddled statements, etc. You also check and let me know. If there are still 2 gci issues, please tell me how I can solve them, because I have tried a lot but am unable to fix them. Kindly guide me.
**$ golangci-lint run internal\auth\ldapauth\ldapauth.go:7:1: File is not properly formatted (gci) "github.com/go-ldap/ldap/v3" ^ internal\auth\ldapauth\ldapauth_test.go:7:1: File is not properly formatted (gci) "github.com/go-ldap/ldap/v3" ^ 2 issues:

gci: 2**

@akshat-kumar-singhal @Umang01-hash

@mundele2004 You can fix gci import order issues by installing and running the gci tool.
go install github.com/daixiang0/gci@latest
and then use gci write . inside the directory ldapauth. It should fix these errors.

@Umang01-hash I tried the steps you suggested, but those 2 issues are still not resolved. Please guide me on how to fix those errors.

mundele2004 · 2025-08-12T17:44:38Z

Please check — I have fixed the linter issues such as whitespace, cuddled statements, etc. You also check and let me know. If there are still 2 gci issues, please tell me how I can solve them, because I have tried a lot but am unable to fix them. Kindly guide me.
**$ golangci-lint run internal\auth\ldapauth\ldapauth.go:7:1: File is not properly formatted (gci) "github.com/go-ldap/ldap/v3" ^ internal\auth\ldapauth\ldapauth_test.go:7:1: File is not properly formatted (gci) "github.com/go-ldap/ldap/v3" ^ 2 issues:

gci: 2**

@akshat-kumar-singhal @Umang01-hash

@mundele2004 You can fix gci import order issues by installing and running the gci tool.
go install github.com/daixiang0/gci@latest
and then use gci write . inside the directory ldapauth. It should fix these errors.
@Umang01-hash I tried the steps you suggested, but those 2 issues are still not resolved. Please guide me on how to fix those errors.

@Umang01-hash
I have resolved all the issues, including the merge conflicts and the gci import order problems. I installed the gci tool and ran gci write . inside the ldapauth directory as suggested, and now golangci-lint passes without errors.

Everything is working fine now. ✅

mundele2004 · 2025-08-14T16:29:03Z

Please tell me what I should do to fix this:
Workflow-Pipeline / PKG Unit Testing (v1.22)🛠 (pull_request)
@Umang01-hash

mundele2004 · 2025-08-15T04:33:29Z

Please tell me what I should do to fix this:
Workflow-Pipeline / PKG Unit Testing (v1.22)🛠 (pull_request)
@Umang01-hash @akshat-kumar-singhal

mundele2004 · 2025-08-18T13:45:12Z

Please tell me what I should do to fix this:
Workflow-Pipeline / PKG Unit Testing (v1.22)🛠 (pull_request)
@Umang01-hash @akshat-kumar-singhal

Umang01-hash and others added 4 commits July 9, 2025 11:45

Merge branch 'main' of github.com:gofr-dev/gofr into release/v1.42.3

d0b103a

udpdate release version to v1.42.3

b560a96

Merge pull request gofr-dev#2047 from gofr-dev/release/v1.42.3

4bcc782

Release/v1.42.3

feat: add LDAP authentication module with JWT issuance

4894ffb

mundele2004 marked this pull request as ready for review July 17, 2025 16:22

gizmo-rt reviewed Jul 18, 2025

View reviewed changes

test: add edge case tests for LDAP failures and update main.go after …

57ecc90

…final testing

Merge branch 'development' into feature/ldap-auth

68a6d3f

chore: fix golangci-lint errors and clean code formatting

9578e40

fix: resolved merge conflict in version.go

e324976

akshat-kumar-singhal suggested changes Jul 31, 2025

View reviewed changes

internal/auth/ldapauth/ldapauth.go Outdated Show resolved Hide resolved

internal/auth/ldapauth/ldapauth.go Outdated Show resolved Hide resolved

internal/auth/ldapauth/ldapauth.go Outdated Show resolved Hide resolved

mundele2004 force-pushed the feature/ldap-auth branch from aeb2768 to e324976 Compare August 1, 2025 18:19

Merge branch 'development' into feature/ldap-auth

0077f56

mundele2004 requested a review from akshat-kumar-singhal August 1, 2025 18:29

mundele2004 added 3 commits August 10, 2025 15:26

Backup before running gci

466a46b

fix all linter issue

2ea5d3b

Fix import formatting to comply with gci linter

81699e5

Merge branch 'development' into feature/ldap-auth

73f8018

mundele2004 added 2 commits August 12, 2025 22:28

Fix gci import order in ldapauth package

9d6318d

Fix gci import order in ldapauth package

b3e3610

Merge branch 'development' into feature/ldap-auth

ec784f3

Merge branch 'development' into feature/ldap-auth

fed560a

coolwednesday and others added 2 commits August 18, 2025 22:42

Merge branch 'development' into feature/ldap-auth

be40c86

Merge branch 'development' into feature/ldap-auth

ea7bfe2

Umang01-hash added the gofr-soc label Aug 20, 2025

Merge branch 'development' into feature/ldap-auth

142eba5

feat: add LDAP authentication module with JWT issuance #2074

Are you sure you want to change the base?

feat: add LDAP authentication module with JWT issuance #2074

Uh oh!

Conversation

mundele2004 commented Jul 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pull Request Template

Summary

What's Included

How to Test

Uh oh!

gizmo-rt left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

gizmo-rt Jul 18, 2025

Choose a reason for hiding this comment

Uh oh!

gizmo-rt Jul 18, 2025

Choose a reason for hiding this comment

Uh oh!

mundele2004 Jul 21, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

gizmo-rt Jul 18, 2025

Choose a reason for hiding this comment

Uh oh!

mundele2004 Jul 21, 2025

Choose a reason for hiding this comment

Uh oh!

gizmo-rt Jul 18, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

mundele2004 commented Jul 21, 2025

Uh oh!

mundele2004 commented Jul 21, 2025

Uh oh!

Umang01-hash commented Jul 24, 2025

Uh oh!

mundele2004 commented Jul 30, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mundele2004 commented Aug 1, 2025

Uh oh!

mundele2004 commented Aug 3, 2025

Uh oh!

akshat-kumar-singhal commented Aug 4, 2025

Uh oh!

mundele2004 commented Aug 10, 2025

Uh oh!

Umang01-hash commented Aug 12, 2025

Uh oh!

mundele2004 commented Aug 12, 2025

Uh oh!

mundele2004 commented Aug 12, 2025

Uh oh!

mundele2004 commented Aug 14, 2025

Uh oh!

mundele2004 commented Aug 15, 2025

Uh oh!

mundele2004 commented Aug 18, 2025

Uh oh!

Uh oh!

mundele2004 commented Jul 17, 2025 •

edited

Loading