[BUG] LDAP Auth

[dr3NRG]

Hi @steveiliop56!

Thanks for the LDAP Auth support, (but pls update the documentation to use it.)
I extracted from the source code

BUG:
after a few minutes the connection to the ldap server is gone and dont connect to it
tinyauth v3.6.0

edit2: response from console
2025-07-11T12:56:13Z WRN Failed to find user in LDAP error="LDAP Result Code 200 "Network Error": ldap: connection closed" username=admin

[steveiliop56]

A guide for LDAP has been added in the documentation. You can check it out here. I am investigating the connection closed issue.

[Raniita]

Hi! I found a typo in the documentation in this section: Using LDAP for user management - Configuring Tinyauth.

In the environment variable LDAP_BASE_DN, the value contains cd=com which should be corrected to dc=com.

After fixing this typo, I was able to successfully configure LDAP as the single source of authentication 🥇

[steveiliop56]

Fixed the typo in the guide. I am working on a solution to the connection issue. I should have a patch by tomorrow.

[steveiliop56]

@dr3NRG can you try v3.6.1-beta.1? I added a small heartbeat that does a dumb search every 5 minutes in order to keep the LDAP connection alive.

[dr3NRG]

@steveiliop56 thanks for the fix, but I dont think its the best solution for the problem,
the heartbeat what u add to the code, need continous connection (i think), maybe i would be better if connect to the ldap server when its need,
no need continuous connection to the ldap server, so less resources are needed, and the dont spam the network

my opinion for the problem:
check the auth server (ldap) when the app starting, save it somewhere its exist and connect to the ldap (ms active directory for me) when somebody want to login
please take advantage of this opportunity

v3.6.1-beta.1: its working

[steveiliop56]

@dr3NRG I decided to go with a hearbeat because this way I can ensure a fast login. There is no way to tell if the connection has timed out without performing an action so, if the action takes 1 second to fail then we need another 3 to 5 seconds to reconnect which adds a ~5 second delay to the login screen. I believe that this won't be a pleasant experience to the users. As for the heartbeat I decided to simplify it and bit and use something like:

// Create a search request to find the user by username
searchRequest := ldapgo.NewSearchRequest(
	"",
	ldapgo.ScopeBaseObject, ldapgo.NeverDerefAliases, 0, 0, false,
	"(objectClass=*)",
	[]string{},
	nil,
)

// Perform the search
_, err := l.Conn.Search(searchRequest)
if err != nil {
	return err
}

Which should work with all LDAP servers and have no overhead. What do you think?

[dr3NRG]

you are right, its a resaonable solution

this issue can be closed

[steveiliop56]

Cool. Closing this issue and expect v3.6.1 later today.

[dr3NRG]

thanks, finally i can trash authentik