Data Validation
Relevant source files
The following files were used as context for generating this wiki page:
Data validation in flext-ldap is a multi-layered system designed to ensure the integrity and security of LDAP operations. It encompasses structural validation of Distinguished Names (DNs), LDAP filter syntax verification, and attribute-level checks. This system prevents common issues such as LDAP injection and malformed requests before they reach the directory server.
The validation logic is primarily exposed through the FlextLdapValidations class and integrated into domain models using Pydantic for automated schema enforcement. This architecture ensures that both manual input and automated data flows remain compliant with LDAP standards and business rules defined within the Domain Services.
Sources: examples/README.md:144-154, src/flext_ldap/_utilities/validation.py
Core Validation Architecture
The validation system is organized into utility classes and model-driven constraints. The primary entry point for manual validation is the validations.py module, while automated validation is handled via Pydantic models in models.py.
Validation Components
| Component | Description |
|---|---|
validate_dn | Verifies the structural correctness of an LDAP Distinguished Name. |
validate_filter | Ensures LDAP search filters follow RFC syntax and are safe from injection. |
SearchRequest | A Pydantic model that validates search parameters (scope, size limits, attributes). |
FlextLdapValidations | The primary namespace class for domain-specific validation patterns. |
Sources: examples/README.md:144-154, tests/unit/test_models_search.py:25-45
Validation Workflow
The following diagram illustrates how validation is applied before an LDAP operation is executed.
This workflow demonstrates that validation occurs at the perimeter, ensuring only sanitized data reaches the core execution engine.
Sources: examples/README.md:374-390, tests/unit/test_utilities.py:420-435
LDAP Structural Validation
Distinguished Name (DN) Validation
DN validation checks for correct syntax, including required components and special character escaping. The library handles complex DNs including those with escaped commas or special characters.
from flext_ldap import FlextLdapValidations
# Validate DN
dn_result = FlextLdapValidations.validate_dn("cn=user,dc=example,dc=com")
if dn_result.is_failure:
logger.error(f"Invalid DN: {dn_result.error}")
Sources: examples/README.md:374-383, tests/constants.py:408-415
Filter Syntax and Sanitization
Search filters are validated to ensure they are properly balanced and utilize valid operators. This process includes input sanitization to prevent security vulnerabilities such as LDAP injection.
Model-Based Validation
The project utilizes Pydantic models to enforce data types and constraints on configuration and request objects.
Search Options Validation
The SearchOptions model ensures that critical parameters like base_dn are present and that numeric limits are within acceptable ranges.
- Required Fields:
base_dncannot be empty. - Default Values:
scopedefaults toSUBTREE, andfilter_strdefaults to(objectClass=*). - Normalization: Scope values are normalized from strings (e.g., "subtree") to canonical uppercase forms.
Sources: tests/unit/test_models_search.py:25-70, tests/constants.py:321-335
Configuration Validation
LDAP connection settings are validated upon initialization. This includes port range checks and security configuration consistency.
| Field | Validation Rule |
|---|---|
port | Must be between 1 and 65535. |
host | Must be a valid hostname or IP (non-empty). |
use_ssl/use_tls | Validated as boolean flags; checked for mutual compatibility. |
Sources: tests/unit/test_config.py:25-80, tests/constants.py:112-125
Business Rule Validation
Beyond structural checks, the domain.py module implements the Specification Pattern for business-level validation.
- UserSpecification: Enforces rules for usernames, email formats, and password policies.
- GroupSpecification: Validates group membership rules and naming conventions.
- SearchSpecification: Ensures search filters comply with organizational security policies.
Sources: examples/README.md:218-232, tests/unit/test_models_sync.py:53-65
Conclusion
Data validation in flext-ldap provides a robust defense-in-depth strategy. By combining static utility checks for LDAP primitives (DNs and filters) with dynamic Pydantic models for configuration and the Specification Pattern for business logic, the library ensures that all directory operations are safe, predictable, and compliant with enterprise standards.
Sources: examples/README.md:405-415