LDAP: add local auth fallback for regular users - #3657
Open
kboykov wants to merge 2 commits into
Open
Conversation
When `ldapFallbackToLocalAuth` is set to true in config, any non-API non-system user with a local password can authenticate via Espo's local auth if LDAP is unavailable or rejects the credentials. This extends the existing admin-only fallback to cover all user types, and also adds fallback coverage for the case where LDAP accepts the user's DN but rejects the password bind — a path that previously had no fallback at all. Default is false, preserving existing behaviour.
Author
kboykov
force-pushed
the
ldap-local-auth-fallback
branch
from
April 29, 2026 14:52
4c88f9d to
4bdb74e
Compare
Contributor
|
Hi, Thanks for the PR. I'm not sure it's good to replicate the same fallback mechanism that we have for admins for regular users. The existing mechanism that it falls back on authentication failure is not a nice approach. I'm not sure we need to continue with the same approach. |
|
Hi @kboykov, solid work on the LDAP fallback logic.Quick question regarding naming: In localLogin, we're using $adminUser even for non-admin users. It feels a bit misleading. Would you mind renaming that to just $user or $authenticatedUser to keep things clear?Otherwise, everything else (especially the #[SensitiveParameter] usage) looks great. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #1948.
Currently, when LDAP authentication is enabled, only admin users can fall back to local Espo authentication (when the LDAP server is unreachable or the user is not found in LDAP). Regular users — such as contractors and partners who are not present in the LDAP/AD tree — have no fallback at all. There is also no fallback of any kind when LDAP accepts a user's DN but rejects the password bind.
This PR adds an opt-in
ldapFallbackToLocalAuthconfig flag (default:false, so existing behaviour is fully preserved). When enabled:The existing
adminLogin()method is left untouched. A newlocalLogin()method handles the broader user scope, with the same type exclusions as the downstream user lookup (TYPE_API,TYPE_SYSTEM,TYPE_SUPER_ADMIN).