Login with using username or email about meteor-accounts-ldap

[JackAdams]

The way I've got it working (i.e. accepts email or username) with an active directory is to just use the default settings. i.e. not changing LDAP.searchField or LDAP.searchValueType.

It's so long since I've touched this part of the code, I can't really remember much about it. These are the default functions (that you can completely overwrite to get what you need):

LDAP.filter = function (isEmailAddress, usernameOrEmail, FQDN) {
  var searchField = (_.isFunction(LDAP.searchField)) ? LDAP.searchField.call(this) : LDAP.searchField;
  var searchValue = LDAP.searchValue.call(this, isEmailAddress, usernameOrEmail, FQDN);
  return '(&(' + searchField + '=' + searchValue + ')(objectClass=user))';
}

LDAP.searchValue = function (isEmailAddress, usernameOrEmail, FQDN) {
  var username = (isEmailAddress) ? usernameOrEmail.split('@')[0] : usernameOrEmail;
  var searchValue;
  var searchValueType = (_.isFunction(LDAP.searchValueType)) ? LDAP.searchValueType.call(this) : LDAP.searchValueType;
  switch (searchValueType) {
	case 'userPrincipalName' :
	  searchValue = username + '@' + FQDN;
	  break;
	case 'email' :
	  searchValue = (isEmailAddress) ? userNameOrEmail : username + '@' + FQDN; // If it's not an email address, we're kind of guessing
	  break;
	case 'username' :
	default :
	  searchValue = username;
  }
  return searchValue;
}

[pisacode]

Thanks a lot, I will try and let you know how that goes.

[JackAdams]

On reviewing the LDAP.searchValue function above, it looks like the intention is for the userPrincipalName option is to accept either a username or an email address. Not sure why the email address would be failing (unless the part of the email address before the @ is different from the username for the user records in the AD).

[pisacode]

Hey I just found out that , as you mentioned, the part of the email address before the @ is different from the username for the user records in the AD. You were right sir..

I have implemented your suggestion from the readMe and the code looks like this:

LDAP.multitenantIdentifier = 'organization_id';

LDAP.filter = function (isEmailAddress, usernameOrEmail, FQDN) { return '(&(' + ((isEmailAddress) ? 'mail' : 'userPrincipalName') + '=' + usernameOrEmail + ')(objectClass=user))'; }

LDAP.searchValue = function (isEmailAddress, usernameOrEmail, FQDN) {
  var username = (isEmailAddress) ? usernameOrEmail.split('@')[0] : usernameOrEmail;
  var searchValue;
  var searchValueType = (_.isFunction(LDAP.searchValueType)) ? LDAP.searchValueType.call(this) : LDAP.searchValueType;
  switch (searchValueType) {
    case 'userPrincipalName':
      searchValue = username + '@' + FQDN;
      break;
    case 'email':
      searchValue = (isEmailAddress) ? userNameOrEmail : username + '@' + FQDN; // If it's not an email address, we're kind of guessing
      break;
    case 'username':
    default:
      searchValue = username;
  }
  return searchValue;
}

however, it is still not working on this situation.

Since I have only two possibilities for the login I have also tried this code but it also didn't work

LDAP.bindValue = function (usernameOrEmail, isEmailAddress, FQDN) {
  LDAP.searchField = ((isEmailAddress) ? 'mail' : 'userPrincipalName');
  LDAP.searchValueType = ((isEmailAddress) ? 'mail' : 'userPrincipalName');
  return ((isEmailAddress) ? usernameOrEmail : usernameOrEmail + '@' + FQDN)
}

[pisacode]

Apparently, having different email address than userPrincipalName is a very bad thing for the AD structure. Therefore we decided to use only userPrincipalName for the LDAP. I am closing this issue because the problem was caused by the AD not this repository. Thanks for the help

[JackAdams]

Thanks for following up. I appreciate it.