LDAP Provider
Relevant source files
The following files were used as context for generating this wiki page:
The LDAP Provider is a specialized authentication component within the flext-auth service designed for enterprise-grade directory service integration. It allows the system to delegate authentication and authorization tasks to external Lightweight Directory Access Protocol (LDAP) servers, enabling centralized user management and single sign-on capabilities across an organization.
In the context of the flext-auth architecture, the LDAP Provider is categorized as a core provider type, facilitating the mapping of directory-based identities into the internal AuthIdentity model used by the service. This integration ensures that enterprise users can access flext-auth protected resources using their existing corporate credentials.
Sources: src/flext_auth/constants.py:108, README.md:10-15
Architecture and Integration
The LDAP Provider is integrated into the flext-auth framework as a type-safe provider defined within the ProviderTypes enumeration. It operates alongside other authentication methods like JWT and OAuth2, providing a robust option for internal corporate environments.
Provider Classification
The system utilizes a central constant registry to define valid provider behaviors. The LDAP provider is explicitly defined as an enterprise provider type, distinguished from basic or certificate-based methods.
The diagram shows how the LDAP Provider sits within the broader provider registry, managed by the authentication engine to verify identities.
Sources: src/flext_auth/constants.py:100-115
Configuration and Constants
The LDAP provider's behavior is governed by strict domain constants that ensure type-safe interactions and Pydantic validation throughout the authentication lifecycle.
Domain Constants
Relevant constants for the provider's lifecycle include:
| Constant | Type | Description |
|---|---|---|
ProviderTypes.LDAP | StrEnum | The unique identifier for the LDAP provider type. |
VALID_PROVIDER_TYPES | AbstractSet[str] | The immutable set of valid providers, including LDAP. |
DEFAULT_TIMEOUT | float | Connection timeout for external directory requests. |
DEFAULT_MAX_RETRIES | int | Maximum attempts to reach the LDAP server. |
Sources: src/flext_auth/constants.py:108-140
Authentication Flow
The LDAP authentication flow typically involves an identity request that is passed through the FlextAuth facade. The system maps the directory credentials to an internal AuthIdentity if the external verification is successful.
Sequence of Authentication
While the specific implementation details of the LDAP socket communication are abstracted in lower layers, the high-level flow in flext-auth follows this pattern:
This sequence illustrates the delegation of credential verification from the FlextAuth service to the external LDAP directory.
Sources: examples/basic_usage_workflow.py:65-85, examples/comprehensive_demo_03.py:30-45
Role and Permission Mapping
One of the primary functions of the LDAP provider is the synchronization of directory roles with internal system roles. flext-auth defines a set of standard role types that can be assigned to identities verified via LDAP.
Supported Role Types
Identities retrieved via LDAP can be mapped to the following standard roles defined in the system constants:
ADMIN: High-level administrative access.USER: Standard authenticated user access.MODERATOR: Content or system management access.GUEST: Limited temporary access.
Sources: src/flext_auth/constants.py:118-126, examples/advanced_features_02.py:50-65
Error Handling and Security
The LDAP provider adheres to the system's security events and error coding standards. Failures during LDAP operations result in specific error codes to maintain security audit trails.
Common Error Codes
When LDAP operations fail, the following error codes from FlextAuthConstants.Auth.ErrorCodes are typically utilized:
INVALID_CREDENTIALS: Returned when the LDAP BIND operation fails due to incorrect username or password.ACCOUNT_LOCKED: Returned if the LDAP server indicates the account is disabled or locked out at the directory level.DEFAULT_TIMEOUT: Triggered if the LDAP server fails to respond within the configured threshold.
Sources: src/flext_auth/constants.py:270-285, examples/comprehensive_demo_03.py:100-110
Implementation Example
The following snippet demonstrates how a user might be registered or identified within a workflow that could be backed by an LDAP provider, specifically highlighting the role assignment.
# Registration of an enterprise identity with specific roles
# In an LDAP context, these roles would be mapped from directory groups
register_result = auth.register_user(
username="enterprise_user",
email="user@company.com",
password=password,
roles=["user", "moderator"],
)
Sources: examples/basic_usage_workflow.py:30-40
Conclusion
The LDAP Provider acts as a bridge between the flext-auth ecosystem and enterprise identity directories. By utilizing standard StrEnum constants for provider identification and integrating with the service's robust Result pattern for error handling, it ensures that LDAP-based authentication is both secure and developer-friendly.