ldapdir

type Config struct {
	URL    string // ldaps://host, or ldap://host for a plaintext one
	BaseDN string // where the people are

	// BindDN and BindPassword are how this server reads the directory. An
	// anonymous read is allowed by leaving them empty, which some directories
	// permit and most do not.
	BindDN       string
	BindPassword string

	// UserFilter selects the people. The default, [DefaultUserFilter], is
	// (|(objectClass=posixAccount)(objectClass=account)(objectClass=uidObject)).
	//
	// ⛔ It was (objectClass=posixAccount) up to v0.13.0, and the change
	// WIDENS what a directory gives by default: an entry of class account
	// (RFC 4524) or uidObject (RFC 4519) that is not a posixAccount was left
	// out before and is read now. Set UserFilter to the old value to keep the
	// old set.
	UserFilter    string
	UserAttribute string // default uid

	// TOTPAttribute is where a one-time-code secret lives, in base32. It has
	// NO default on purpose: there is no standard attribute for it -- FreeIPA
	// has ipatokenOTPkey, other schemas have oathSecret or something local --
	// and a default that guessed wrong would read nothing while looking like
	// it had looked.
	TOTPAttribute string

	// Attributes are what to copy from each person's entry, as the directory
	// names them -- ["mail", "uidNumber", "homeDirectory"] -- into
	// [github.com/go-authn/directory.Identity.Attributes]. They describe and
	// prove nothing, and none of them may be a credential: [New] refuses
	// what [github.com/go-authn/directory.CheckAttributeName] refuses, and
	// TOTPAttribute, which holds a secret under a name only this
	// configuration knows. Nothing is copied by default.
	//
	// An attribute is copied under the spelling written here, whatever case
	// the directory answers in. Subtypes it returns besides -- description;
	// lang-fr, for description -- are not: ask for them by name.
	Attributes []string

	// GroupAttributes are the same for each group: ["gidNumber"]. The
	// member attribute is refused, since Members is how membership is read.
	GroupAttributes []string

	// ObjectClasses are the auxiliary object classes every person this
	// source hands out is DECLARED to carry -- ["supannPerson", "eduPerson"]
	// -- and GroupObjectClasses the same for every group. [New] refuses a name
	// that is not an RFC 4512 descriptor (see
	// [github.com/go-authn/directory.CheckObjectClassName]).
	//
	// ⛔ Declared, never read: an entry's own objectClass values are not
	// copied, and objectClass cannot be named in Attributes. What the upstream
	// directory files a person under is ITS schema; what this source's people
	// are published as is the configuration's promise. See
	// [github.com/go-authn/directory.ObjectClasses].
	ObjectClasses      []string
	GroupObjectClasses []string

	GroupBaseDN    string // default: BaseDN
	GroupFilter    string // default DefaultGroupFilter: posixGroup or groupOfNames
	GroupAttribute string // default cn

	// MemberAttribute, when set, is the ONE attribute a group's members are
	// read from, and overrides the default. Left empty, both are read:
	// memberUid (a posixGroup's, names) and member (a groupOfNames's, DNs).
	//
	// Either way a value that is a DN is mapped to a person only through
	// the people this source imports -- the entries its own people search
	// returns -- by distinguishedNameMatch on their DNs. A DN outside them,
	// or naming nobody imported, maps to nobody: see [Source.Members].
	MemberAttribute string

	// TLS is used for ldaps:// and for StartTLS. A nil one means TLS 1.2 and
	// the system roots, which is the right default and the one a caller
	// overrides to pin a private CA.
	TLS *tls.Config

	// StartTLS upgrades a plaintext connection before binding. A directory
	// reached over ldap:// without it sends the bind password in the clear,
	// so [New] refuses ldap:// to anything but loopback without it.
	StartTLS bool
}

type Source struct {
	// contains filtered or unexported fields
}