{"action":"created","issue":{"url":"https://api.github.com/repos/feathersjs-ecosystem/feathers-authentication-ldap/issues/33","repository_url":"https://api.github.com/repos/feathersjs-ecosystem/feathers-authentication-ldap","labels_url":"https://api.github.com/repos/feathersjs-ecosystem/feathers-authentication-ldap/issues/33/labels{/name}","comments_url":"https://api.github.com/repos/feathersjs-ecosystem/feathers-authentication-ldap/issues/33/comments","events_url":"https://api.github.com/repos/feathersjs-ecosystem/feathers-authentication-ldap/issues/33/events","html_url":"https://github.com/feathersjs-ecosystem/feathers-authentication-ldap/issues/33","id":361873419,"node_id":"MDU6SXNzdWUzNjE4NzM0MTk=","number":33,"title":"Active Directory Login requires a little more work than the example shows.","user":{"login":"nathanbrizzee","id":7914937,"node_id":"MDQ6VXNlcjc5MTQ5Mzc=","avatar_url":"https://avatars2.githubusercontent.com/u/7914937?v=4","gravatar_id":"","url":"https://api.github.com/users/nathanbrizzee","html_url":"https://github.com/nathanbrizzee","followers_url":"https://api.github.com/users/nathanbrizzee/followers","following_url":"https://api.github.com/users/nathanbrizzee/following{/other_user}","gists_url":"https://api.github.com/users/nathanbrizzee/gists{/gist_id}","starred_url":"https://api.github.com/users/nathanbrizzee/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nathanbrizzee/subscriptions","organizations_url":"https://api.github.com/users/nathanbrizzee/orgs","repos_url":"https://api.github.com/users/nathanbrizzee/repos","events_url":"https://api.github.com/users/nathanbrizzee/events{/privacy}","received_events_url":"https://api.github.com/users/nathanbrizzee/received_events","type":"User","site_admin":false},"labels":[{"id":496569652,"node_id":"MDU6TGFiZWw0OTY1Njk2NTI=","url":"https://api.github.com/repos/feathersjs-ecosystem/feathers-authentication-ldap/labels/wontfix","name":"wontfix","color":"ffffff","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2018-09-19T18:32:00Z","updated_at":"2018-12-20T21:36:58Z","closed_at":null,"author_association":"NONE","body":"Thanks for all the work on this module.  For me, I had to make some modifications to the example to get it to work properly.\r\n\r\nFollowing the example, I would get the error:\r\nerror: OperationsError: 000004DC: LdapErr: DSID-0C090A22, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v3839\r\n\r\nOr I would get Invalid username/password.\r\n\r\nSo, following some code examples I found elsewhere, I was able to change the code shown in the example to the following and it now works for me.\r\n\r\n**default.json**\r\n```\r\n  \"authentication\": {\r\n    \"strategies\": [\r\n      \"jwt\",\r\n      \"local\",\r\n      \"ldap\"\r\n    ],\r\n    \"local\": {\r\n      \"entity\": \"user\",\r\n      \"usernameField\": \"username\",\r\n      \"passwordField\": \"password\"\r\n    },\r\n    \"ldap\": {\r\n      \"name\": \"ldap\",\r\n      \"server\": {\r\n        \"url\": \"ldap://10.0.0.34:389/\",\r\n        \"searchBase\": \"dc=mydomain,dc=com\",\r\n        \"searchFilter\": \"(|(userPrincipalName={{username}})(sAMAccountName={{username}}))\",\r\n        \"searchAttributes\": null\r\n      },\r\n      \"passRequestToCallback\": true\r\n    }\r\n  },\r\n```\r\n\r\n\r\n**authentication.js**\r\n```\r\nconst authentication = require('@feathersjs/authentication');\r\nconst jwt = require('@feathersjs/authentication-jwt');\r\nconst local = require('@feathersjs/authentication-local');\r\nconst ldap = require('feathers-authentication-ldap');\r\n\r\nmodule.exports = function (app) {\r\n  const config = app.get('authentication');\r\n\r\n  // Set up authentication with the secret\r\n  app.configure(authentication(config));\r\n  app.configure(jwt());\r\n  app.configure(local());\r\n  app.configure(ldap({\r\n    asyncOptions: req => {\r\n      // If their username doesn't contain @domain.whatever, we need to add it\r\n      // for Active Directory to be able to authenticate the user and look them up.\r\n      // Grab it from the searchBase which looks like \"searchBase\": \"cn=users,dc=mydomain,dc=com\"\r\n      let username = req.body.username || '';\r\n      if (username.indexOf('@') === -1) {\r\n        let domain = '';\r\n        let searchBase = (config.ldap.server.searchBase || '').split(',');\r\n        if (searchBase && searchBase.length) {\r\n          searchBase.forEach(element => {\r\n            if (element.includes('dc=')) {\r\n              const indx = element.indexOf('=') + 1;\r\n              if (domain) {\r\n                domain += '.';\r\n              }\r\n              domain += element.substring(indx);\r\n            }\r\n          });\r\n        }\r\n        username += '@' + domain;\r\n      }\r\n      return({ server: { bindDn: username, bindCredentials: req.body.password } });\r\n    }\r\n  }));\r\n\r\n  // The `authentication` service is used to create a JWT.\r\n  // The before `create` hook registers strategies that can be used\r\n  // to create a new valid JWT (e.g. local or oauth2)\r\n  app.service('authentication').hooks({\r\n    before: {\r\n      create: [\r\n        authentication.hooks.authenticate(config.strategies),\r\n        function (hook) {\r\n          // Restore the original authentication type from the jwt if they logged back in using only the jwt\r\n          if (hook.data.strategy === 'jwt' && hook.data.accessToken) {\r\n            const myjwt = decode(hook.data.accessToken);\r\n            const strategy = myjwt.strategy;\r\n            hook.params.payload = hook.params.payload || {};\r\n            // hook.params.payload.userId should already be on the payload from the framework if using Local logins\r\n            hook.params.payload.strategy = strategy;  // Store the auth strategy this JWT was issued against.\r\n          } else {\r\n            hook.params.payload.strategy = hook.data.strategy;\r\n            // user.username when local auth, user.sAMAccountName when active directory\r\n            hook.params.payload.username = hook.params.user.username || hook.params.user.sAMAccountName || '';\r\n            hook.params.payload.userId = hook.params.payload.userId || null; // Or unique ID from whatever the user table is\r\n          }\r\n          return Promise.resolve(hook);\r\n        }        \r\n      ],\r\n      remove: [\r\n        authentication.hooks.authenticate('jwt')\r\n      ]\r\n    }\r\n  });\r\n};\r\n```\r\n\r\n\r\n**Postman API data**\r\n```\r\n// My Active Directory Usernames are firstname.lastname\r\n// This works\r\n{\r\n\t\"strategy\": \"ldap\",\r\n\t\"username\": \"firstname.lastname\",\r\n\t\"password\": \"supersecret\"\r\n}\r\n\r\n// And so does this\r\n{\r\n\t\"strategy\": \"ldap\",\r\n\t\"username\": \"firstname.lastname@mydomain.com\",\r\n\t\"password\": \"supersecret\"\r\n}\r\n```\r\n\r\nHope this helps someone else struggling with Active Directory Login.\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/feathersjs-ecosystem/feathers-authentication-ldap/issues/comments/449143370","html_url":"https://github.com/feathersjs-ecosystem/feathers-authentication-ldap/issues/33#issuecomment-449143370","issue_url":"https://api.github.com/repos/feathersjs-ecosystem/feathers-authentication-ldap/issues/33","id":449143370,"node_id":"MDEyOklzc3VlQ29tbWVudDQ0OTE0MzM3MA==","user":{"login":"nathanbrizzee","id":7914937,"node_id":"MDQ6VXNlcjc5MTQ5Mzc=","avatar_url":"https://avatars2.githubusercontent.com/u/7914937?v=4","gravatar_id":"","url":"https://api.github.com/users/nathanbrizzee","html_url":"https://github.com/nathanbrizzee","followers_url":"https://api.github.com/users/nathanbrizzee/followers","following_url":"https://api.github.com/users/nathanbrizzee/following{/other_user}","gists_url":"https://api.github.com/users/nathanbrizzee/gists{/gist_id}","starred_url":"https://api.github.com/users/nathanbrizzee/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nathanbrizzee/subscriptions","organizations_url":"https://api.github.com/users/nathanbrizzee/orgs","repos_url":"https://api.github.com/users/nathanbrizzee/repos","events_url":"https://api.github.com/users/nathanbrizzee/events{/privacy}","received_events_url":"https://api.github.com/users/nathanbrizzee/received_events","type":"User","site_admin":false},"created_at":"2018-12-20T21:36:58Z","updated_at":"2018-12-20T21:36:58Z","author_association":"NONE","body":"@aditya02maurya  I used Ubuntu Linux 18.04.  I updated all my packages to the latest versions today and now I get an error.  I tried it both on Windows 10 and Ubuntu Linux 18.04.  They both give the following error:\r\n\r\n`\r\ninfo: Feathers application started on http://localhost:3030\r\nerror: Unhandled Rejection at: Promise  {\"_bitField\":18087936,\"_fulfillmentHandler0\":{\"name\":\"SequelizeAccessDeniedError\",\"parent\":{\"message\":\"Login failed. The login is from an untrusted domain and cannot be used with Windows authentication.\",\"code\":\"ELOGIN\"},\"original\":{\"message\":\"Login failed. The login is from an untrusted domain and cannot be used with Windows authentication.\",\"code\":\"ELOGIN\"}},\"meta\":[{\"isFulfilled\":false,\"isRejected\":true,\"rejectionReason\":{\"name\":\"SequelizeAccessDeniedError\",\"parent\":{\"message\":\"Login failed. The login is from an untrusted domain and cannot be used with Windows authentication.\",\"code\":\"ELOGIN\"},\"original\":{\"message\":\"Login failed. The login is from an untrusted domain and cannot be used with Windows authentication.\",\"code\":\"ELOGIN\"}}},{\"name\":\"SequelizeAccessDeniedError\",\"parent\":{\"message\":\"Login failed. The login is from an untrusted domain and cannot be used with Windows authentication.\",\"code\":\"ELOGIN\"},\"original\":{\"message\":\"Login failed. The login is from an untrusted domain and cannot be used with Windows authentication.\",\"code\":\"ELOGIN\"}}]}\r\n`\r\n\r\nI'm going to investigate it now since it broke.  I need it working for my application.\r\nI'll post an update once I get it working again. :-)"}}
{"actor":{"display_login":"nathanbrizzee"}}