feat: configurable LDAPS hostname (ldapsHost/ldapsPort) and extensive docs (#89)

Add conf.ldap.ldapsHost / conf.ldap.ldapsPort so the /integrations page
can advertise an internal-only LDAPS hostname separate from the public
OAuth issuer. This avoids forcing admins to port-forward 636 publicly.

- routes/index.js derives LDAPS URL from ldapsHost/ldapsPort with issuer fallback
- integrations.ejs adds a contextual help panel explaining TLS hostname
  validation, the public-issuer default, and recommended internal-DNS /
  Docker-internal alternatives
- conf/base.js, secrets.js.example, DEPLOYMENT.md, docs/configuration.md,
  and docs/ldap.md document and expose the new options
- Add tests/integrations.test.js for default and custom ldapsHost behavior
- Bump version to 1.1.17

Co-authored-by: Claude <noreply@anthropic.com>

.github/workflows/pr-tests.yml

@@ -136,6 +136,10 @@ jobs:
           # directory layout (dc=example,dc=com) -- only the admin password
           # (normally supplied via a gitignored secrets.js) needs setting.
           app_ldap__bindPassword: your-ldap-password
+          # routes/oauth.js now refuses to start without a real jwtSecret.
+          # This is a non-secret test value; the container under test uses
+          # secrets.js.example's jwtSecret independently.
+          app_oauth__jwtSecret: ci-test-jwt-secret-do-not-use-in-production
         run: npm test
 
   test-summary:

CHANGELOG.md

@@ -6,6 +6,34 @@ correspond to git tags (`vX.Y.Z`) and `nodejs/package.json`'s `version`.
 
 ## [Unreleased]
 
+## [1.1.17] - 2026-07-18
+
+### Added
+- `conf.ldap.ldapsHost` and `conf.ldap.ldapsPort` config options (also settable via `app_ldap__ldapsHost` / `app_ldap__ldapsPort`). When `ldapsHost` is set, the `/integrations` page advertises that hostname for direct LDAPS binds instead of deriving it from the public OAuth issuer. This lets operators use an internal-only hostname (e.g. `ldap.internal.example.com` or `sso-manager` on the Docker network) and avoid port-forwarding 636 to the internet.
+- A contextual help panel on `/integrations` → LDAP explaining why LDAPS needs a hostname (not an IP), why 636 should not be publicly forwarded, and the recommended internal-DNS / Docker-internal alternatives.
+
+### Changed
+- `routes/index.js` now computes the displayed LDAPS URL from `conf.ldap.ldapsHost`/`ldapsPort` with fallback to the OAuth issuer host for backward compatibility.
+- `secrets.js.example`, `docs/configuration.md`, `docs/ldap.md`, and `DEPLOYMENT.md` document the new `ldapsHost`/`ldapsPort` options and recommended network layouts.
+- Bumped version to `1.1.17` in `nodejs/package.json`.
+
+## [1.1.16] - 2026-07-18
+
+### Security
+- Hardened LDAP filter and DN construction against injection. All user-supplied values interpolated into group filters (`models/group_ldap.js`) and RDN values used when adding users/groups (`models/user_ldap.js`) are now escaped before being sent to the LDAP server.
+- Replaced `Math.random()`-based token generation in `models/token.js`, `models/oauth_code.js`, and `models/oauth_client.js` with `crypto.randomUUID()` for session tokens, OAuth codes, access/refresh tokens, and client IDs.
+- Replaced `Math.random()`-based OTP generation in `OtpToken.issue()` with `crypto.randomInt()`.
+- `routes/oauth.js` now refuses to start if `oauth.jwtSecret` is missing or still set to the placeholder value, instead of falling back to a hardcoded public string.
+- Rendered docs and Terms-of-Service HTML in `routes/docs.js` and `routes/index.js` are now sanitized with `xss` to prevent stored XSS from malicious markdown.
+- Removed a `console.log` that wrote new-user data (including password hashes) to the log in `models/user_ldap.js`; reduced login-path error logging to `error.name`/`error.message` only.
+
+### Changed
+- Public-release packaging: removed `"private": true` from `nodejs/package.json` and bumped version to `1.1.16`.
+- CI workflow (`.github/workflows/pr-tests.yml`) now sets `app_oauth__jwtSecret` so the test suite can run against the new startup-time JWT validation.
+
+### Fixed
+- `models/email.js`: fixed a template bug where the rendered `from` address used `template.message` instead of `template.from`.
+
 ## [1.1.15] - 2026-07-18
 
 ### Changed
@@ -116,7 +144,7 @@ First tagged release. Establishes the `vX.Y.Z` tag convention that the in-app up
 - Unix/POSIX and LDAP bind-only service account support, distinct from real-person accounts.
 - Merged OAuth Apps + LDAP Info into a single Integrations page.
 
-[Unreleased]: https://github.com/theta42/sso-manager-node/compare/v1.1.15...HEAD
+[Unreleased]: https://github.com/theta42/sso-manager-node/compare/v1.1.16...HEAD
 [1.1.15]: https://github.com/theta42/sso-manager-node/compare/v1.1.14...v1.1.15
 [1.1.14]: https://github.com/theta42/sso-manager-node/compare/v1.1.13...v1.1.14
 [1.1.13]: https://github.com/theta42/sso-manager-node/compare/v1.1.12...v1.1.13

DEPLOYMENT.md

@@ -188,6 +188,12 @@ valid 10 years, SAN includes the CN + `localhost` + `127.0.0.1`) and listens on
 `ldap-certs` volume so it persists across container recreation — clients don't need
 to re-trust on every rebuild.
 
+The `/integrations` page derives its LDAPS URL from the OAuth issuer by default.
+To advertise a separate, internal-only hostname (e.g. `ldap.internal.example.com`
+or `sso-manager` for Docker-internal clients), set `conf.ldap.ldapsHost` in your
+secrets file or pass `app_ldap__ldapsHost=...`. See `docs/ldap.md` for
+recommended network layouts and how to match the cert SAN to the hostname.
+
 - **Trusting the self-signed cert** (clients): copy `/etc/openldap/certs/ldap.crt`
   out of the container and add it to the client's trusted CA store, or set
   `TLS_REQCERT never` for quick-and-dirty LAN use. Fetch it with:

docs/configuration.md

@@ -32,6 +32,8 @@ raw strings otherwise.
 | `app_ldap__userBase=ou=people,dc=…` | `conf.ldap.userBase` | string |
 | `app_ldap__uidGidMin=1500` | `conf.ldap.uidGidMin` | number (new-user id floor) |
 | `app_ldap__uidGidReservedFloor=9000` | `conf.ldap.uidGidReservedFloor` | number (ids at/above this are ignored when allocating) |
+| `app_ldap__ldapsHost=ldap.internal.example.com` | `conf.ldap.ldapsHost` | string (hostname shown on `/integrations` for LDAPS binds; empty = derive from `oauth.issuer`) |
+| `app_ldap__ldapsPort=636` | `conf.ldap.ldapsPort` | number (port shown on `/integrations`) |
 | `app_oauth__jwtSecret=...` | `conf.oauth.jwtSecret` | string |
 | `app_oauth__issuer=https://sso.example.com` | `conf.oauth.issuer` | string |
 | `app_oauth__token_lifetime__access_token=3600` | `conf.oauth.token_lifetime.access_token` | number |

docs/ldap.md

@@ -118,6 +118,81 @@ volumes:
 
 The entrypoint leaves existing certs untouched (idempotent).
 
+## Choosing the LDAPS hostname
+
+The `/integrations` page advertises an **LDAPS URL** for direct LDAP binds. By
+default it derives that URL from the public OAuth issuer (e.g.
+`https://sso.example.com` → `ldaps://sso.example.com:636`). That is convenient,
+but it implies LDAP clients reach your directory through the same public
+hostname — which usually means port-forwarding 636 through your router.
+
+**Do not port-forward LDAPS (636) to the public internet.** LDAP simple binds
+have no rate limiting and are a brute-force target. Instead, use one of these
+internal-only patterns and set `conf.ldap.ldapsHost` (or
+`app_ldap__ldapsHost`) so the `/integrations` page shows the right URL.
+
+### 1. Same Docker / local network host (best for apps on this machine)
+
+If the LDAP client runs on the same Docker network as the SSO Manager (for
+example, the bundled `theta-env` stack), use the internal service name:
+
+```
+ldaps://sso-manager:636
+```
+
+In `conf/secrets.js`:
+
+```javascript
+ldap: {
+  ldapsHost: 'sso-manager',
+  ldapsPort: 636,
+}
+```
+
+The proxy in theta-env already uses this internally. The bundled slapd cert
+includes `sso-manager` in its SAN when `LDAP_CERT_CN` is left at its default,
+so hostname verification works without extra setup.
+
+### 2. LAN host behind your router (best for separate home-lan machines)
+
+Create an internal-only DNS record — e.g. `ldap.internal.example.com` →
+`192.168.1.10` — using your router, Pi-hole, or a local `hosts` file. Then get
+or generate a cert whose SAN/CN matches that internal name:
+
+- **Let's Encrypt wildcard** (`*.internal.example.com`) works if you own the
+  public domain and can complete DNS-01 challenge; the record itself can stay
+  private/routable only inside your LAN.
+- **Internal CA** is fine for a pure LAN: run a small CA, issue a cert for
+  `ldap.internal.example.com`, and distribute the CA cert to clients.
+- **Self-signed** with `LDAP_CERT_CN=ldap.internal.example.com` also works; copy
+  the generated `ldap.crt` to each client and trust it.
+
+In `conf/secrets.js`:
+
+```javascript
+ldap: {
+  ldapsHost: 'ldap.internal.example.com',
+  ldapsPort: 636,
+}
+```
+
+The URL on `/integrations` becomes `ldaps://ldap.internal.example.com:636`.
+
+### 3. Public hostname (acceptable only behind a VPN/firewall)
+
+If a remote host must bind LDAP, put it behind a VPN (Tailscale, WireGuard,
+etc.) or a tightly locked-down firewall rule. In that case the public hostname
+may be appropriate, but the LDAPS port should still not be reachable from the
+open internet.
+
+### Why not just use the LDAP server's IP address?
+
+TLS clients verify the server name against the certificate. Connecting to
+`ldaps://192.168.1.10:636` with a cert issued for `*.internal.example.com`
+will fail hostname verification unless you disable cert checks — which removes
+most of the security benefit of LDAPS. Always use a hostname that matches the
+cert.
+
 ## Service accounts
 
 A service account is a normal `posixAccount` for something that isn't a

nodejs/conf/base.js

@@ -22,6 +22,13 @@ module.exports = {
 		groupBase: 'ou=groups,dc=example,dc=com',
 		userFilter: '(objectClass=posixAccount)',
 		userNameAttribute: 'uid',
+		// Hostname/port advertised on the /integrations page for direct-LDAP
+		// clients. Leave ldapsHost empty to derive it from the OAuth issuer host.
+		// Set it to an internal-only name (e.g. 'ldap.internal.example.com' or
+		// 'sso-manager' on the Docker network) so external clients don't need a
+		// public 636 port forward. See docs/ldap.md.
+		ldapsHost: '',
+		ldapsPort: 636,
 		// New users/personal groups (see addPosixAccount/addPosixGroup in
 		// models/user_ldap.js) get the next uid/gidNumber >= uidGidMin.
 		// Existing entries >= uidGidReservedFloor are ignored when computing

nodejs/models/auth.js

@@ -23,7 +23,7 @@ Auth.login = async function(data){
 
 		return {user, token}
 	}catch(error){
-		console.error("AUTH LOGIN error:", error);
+		console.error("AUTH LOGIN error:", error.name, error.message);
 		throw this.errors.login();
 	}
 };

nodejs/models/email.js

@@ -58,7 +58,7 @@ Mail.sendTemplate = async function(to, template, context, from){
 		to,
 		mustache.render(template.subject, context),
 		mustache.render(template.message, context),
-		from || (template.from && mustache.render(template.message, context))
+		from || (template.from && mustache.render(template.from, context))
 	)
 };
 

nodejs/models/group_ldap.js

@@ -4,6 +4,31 @@ const { Client, Attribute, Change } = require('ldapts');
 const { LRUCache } = require('lru-cache');
 const conf = require('@simpleworkjs/conf').ldap;
 
+// Escape a value used inside an LDAP search filter (RFC 4515).
+function escapeLDAPSearchValue(val) {
+	return String(val)
+		.replace(/\\/g, '\\5c')
+		.replace(/\*/g, '\\2a')
+		.replace(/\(/g, '\\28')
+		.replace(/\)/g, '\\29')
+		.replace(/\0/g, '\\00');
+}
+
+// Escape a value used in an LDAP DN (RFC 4514). Defensive: usernames/cns
+// are normally alphanumeric, but this prevents metacharacter injection.
+function escapeLDAPDNValue(val) {
+	return String(val)
+		.replace(/\\/g, '\\\\')
+		.replace(/,/g, '\\,')
+		.replace(/\+/g, '\\+')
+		.replace(/"/g, '\\"')
+		.replace(/</g, '\\<')
+		.replace(/>/g, '\\>')
+		.replace(/;/g, '\\;')
+		.replace(/=/g, '\\=')
+		.replace(/^\s|\s$/g, match => match === ' ' ? '\\ ' : match);
+}
+
 function makeClient() {
 	return new Client({ url: conf.url });
 }
@@ -19,7 +44,7 @@ async function withClient(fn) {
 }
 
 async function getGroups(client, member){
-	let memberFilter = member ? `(member=${member})`: ''
+	let memberFilter = member ? `(member=${escapeLDAPSearchValue(member)})`: ''
 
 	let groups = (await client.search(conf.groupBase, {
 		scope: 'sub',
@@ -35,7 +60,8 @@ async function getGroups(client, member){
 }
 
 async function addGroup(client, data){
-	await client.add(`cn=${data.name},${conf.groupBase}`, {
+	const safeName = escapeLDAPDNValue(data.name);
+	await client.add(`cn=${safeName},${conf.groupBase}`, {
 		cn: data.name,
 		member: data.owner,
 		description: data.description,
@@ -139,9 +165,10 @@ Group.get = async function(data){
 	}
 
 	return withClient(async (client) => {
+		const safeName = escapeLDAPSearchValue(data.name);
 		let group = (await client.search(conf.groupBase, {
 			scope: 'sub',
-			filter: `(&(objectClass=groupOfNames)(cn=${data.name}))`,
+			filter: `(&(objectClass=groupOfNames)(cn=${safeName}))`,
 			attributes: ['cn', 'description', 'member', 'owner', 'createTimestamp', 'modifyTimestamp'],
 		})).searchEntries[0];
 

nodejs/models/oauth_client.js

@@ -2,7 +2,8 @@
 
 const Table = require('.');
 const bcrypt = require('bcrypt');
-const UUID = function b(a){return a?(a^Math.random()*16>>a/4).toString(16):([1e7]+-1e3+-4e3+-8e3+-1e11).replace(/[018]/g,b)};
+const crypto = require('crypto');
+const UUID = () => crypto.randomUUID();
 const conf = require('@simpleworkjs/conf');
 
 const defaultLifetime = (conf.oauth && conf.oauth.token_lifetime) || {

nodejs/models/oauth_code.js

@@ -1,7 +1,8 @@
 'use strict';
 
 const Table = require('.');
-const UUID = function b(a){return a?(a^Math.random()*16>>a/4).toString(16):([1e7]+-1e3+-4e3+-8e3+-1e11).replace(/[018]/g,b)};
+const crypto = require('crypto');
+const UUID = () => crypto.randomUUID();
 
 // Shared base keyMap matching Token's schema so these behave as tokens
 const tokenKeyMap = {

nodejs/models/token.js

@@ -1,7 +1,8 @@
 'use strict';
 
 const Table = require('.');
-const UUID = function b(a){return a?(a^Math.random()*16>>a/4).toString(16):([1e7]+-1e3+-4e3+-8e3+-1e11).replace(/[018]/g,b)};
+const crypto = require('crypto');
+const UUID = () => crypto.randomUUID();
 
 
 class Token extends Table{
@@ -110,7 +111,7 @@ class OtpToken extends Token {
 		for (const t of existing) {
 			if (t.is_valid) await t.update({is_valid: false});
 		}
-		const code = String(Math.floor(100000 + Math.random() * 900000));
+		const code = String(crypto.randomInt(100000, 1000000));
 		return this.create({uid, code, method, created_by: uid});
 	}
 

nodejs/models/user_ldap.js

@@ -45,6 +45,20 @@ function escapeLDAPSearchValue(val) {
               .replace(/\0/g, '\\00');
 }
 
+// Escape a value used in an LDAP DN (RFC 4514).
+function escapeLDAPDNValue(val) {
+	return String(val)
+		.replace(/\\/g, '\\\\')
+		.replace(/,/g, '\\,')
+		.replace(/\+/g, '\\+')
+		.replace(/"/g, '\\"')
+		.replace(/</g, '\\<')
+		.replace(/>/g, '\\>')
+		.replace(/;/g, '\\;')
+		.replace(/=/g, '\\=')
+		.replace(/^\s|\s$/g, match => match === ' ' ? '\\ ' : match);
+}
+
 // Compute the next available uid/gidNumber: the highest existing value below
 // conf.uidGidReservedFloor, plus one -- or conf.uidGidMin if there are no
 // such entries yet. Entries at/above the reserved floor (e.g. a bootstrap
@@ -72,7 +86,8 @@ async function addPosixGroup(client, data){
 
 	data.gidNumber = nextPosixId(groups, 'gidNumber');
 
-	await client.add(`cn=${data.cn},${conf.groupBase}`, {
+	const safeCn = escapeLDAPDNValue(data.cn);
+	await client.add(`cn=${safeCn},${conf.groupBase}`, {
 	  cn: data.cn,
 	  gidNumber: data.gidNumber,
 	  objectclass: [ 'posixGroup', 'top' ]
@@ -94,6 +109,7 @@ async function addPosixAccount(client, data){
 
 	data.uidNumber = nextPosixId(people, 'uidNumber');
 
+	const safeCn = escapeLDAPDNValue(data.cn);
 	const entry = {
 		cn: data.cn,
 		sn: data.sn,
@@ -143,7 +159,7 @@ async function addPosixAccount(client, data){
 		entry.manager = [].concat(data.manager);
 	}
 
-	await client.add(`cn=${data.cn},${conf.userBase}`, entry);
+	await client.add(`cn=${safeCn},${conf.userBase}`, entry);
 
 	return data
 
@@ -171,7 +187,6 @@ async function addLdapUser(client, data){
 			delete data.userPassword;
 		}
 
-		console.log('addLdapUser', data)
 		group = await addPosixGroup(client, data);
 		data = await addPosixAccount(client, group);
 
@@ -799,7 +814,7 @@ User.addSSHkey = async function(data) {
 // memberUid (RFC 2307, posixGroup) is a bare username, not a DN, unlike
 // groupOfNames' `member` used by app_sso_* groups in group_ldap.js.
 function personalGroupDN(uid){
-	return `cn=${uid},${conf.groupBase}`;
+	return `cn=${escapeLDAPDNValue(uid)},${conf.groupBase}`;
 }
 
 User.getPersonalGroupMembers = async function(uid) {
@@ -873,7 +888,7 @@ User.login = async function(data){
 		return user;
 
 	}catch(error){
-		console.error("USER LOGIN error:", error);
+		console.error("USER LOGIN error:", error.name, error.message);
 		throw error;
 	}
 };

nodejs/package-lock.json

@@ -1,17 +1,17 @@
 {
   "name": "t42-sso-manager",
-  "version": "1.1.15",
+  "version": "1.1.17",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "t42-sso-manager",
-      "version": "1.1.15",
+      "version": "1.1.17",
       "license": "MIT",
       "dependencies": {
         "@fortawesome/fontawesome-free": "^7.3.0",
         "@popperjs/core": "^2.11.8",
-        "@simpleworkjs/conf": "^1.1.0",
+        "@simpleworkjs/conf": "^1.2.0",
         "bcrypt": "^6.0.0",
         "bootstrap": "^5.3.8",
         "compression": "^1.8.1",
@@ -19,7 +19,7 @@
         "express": "^5.2.1",
         "express-rate-limit": "^8.5.2",
         "extend": "^3.0.2",
-        "jq-repeat": "^2.1.0",
+        "jq-repeat": "^2.2.0",
         "jquery": "^3.7.1",
         "jsonwebtoken": "^9.0.3",
         "ldapts": "^8.1.2",
@@ -30,7 +30,8 @@
         "mustache": "^4.2.0",
         "nodemailer": "^9.0.0",
         "p2psub": "^0.2.0",
-        "socket.io": "^4.8.3"
+        "socket.io": "^4.8.3",
+        "xss": "^1.0.15"
       },
       "devDependencies": {
         "jest": "^30.4.2",
@@ -2331,6 +2332,12 @@
         "node": ">= 0.8"
       }
     },
+    "node_modules/commander": {
+      "version": "2.20.3",
+      "resolved": "https://registry.npmjs.org/commander/-/commander-2.20.3.tgz",
+      "integrity": "sha512-GpVkmM8vF2vQUkj2LvZmD35JxeJOLCwJ9cUkugyk2nuhbv3+mJvpLYYt+0+USMxE+oj+ey/lJEnhZw75x/OMcQ==",
+      "license": "MIT"
+    },
     "node_modules/component-emitter": {
       "version": "1.3.1",
       "resolved": "https://registry.npmjs.org/component-emitter/-/component-emitter-1.3.1.tgz",
@@ -2488,6 +2495,12 @@
         "node": ">= 8"
       }
     },
+    "node_modules/cssfilter": {
+      "version": "0.0.10",
+      "resolved": "https://registry.npmjs.org/cssfilter/-/cssfilter-0.0.10.tgz",
+      "integrity": "sha512-FAaLDaplstoRsDR8XGYH51znUN0UY7nMc6Z9/fvE8EXGwvJE9hu7W2vHwx1+bd6gCYnln9nLbzxFTrcO9YQDZw==",
+      "license": "MIT"
+    },
     "node_modules/debug": {
       "version": "4.4.3",
       "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
@@ -6488,6 +6501,22 @@
         }
       }
     },
+    "node_modules/xss": {
+      "version": "1.0.15",
+      "resolved": "https://registry.npmjs.org/xss/-/xss-1.0.15.tgz",
+      "integrity": "sha512-FVdlVVC67WOIPvfOwhoMETV72f6GbW7aOabBC3WxN/oUdoEMDyLz4OgRv5/gck2ZeNqEQu+Tb0kloovXOfpYVg==",
+      "license": "MIT",
+      "dependencies": {
+        "commander": "^2.20.3",
+        "cssfilter": "0.0.10"
+      },
+      "bin": {
+        "xss": "bin/xss"
+      },
+      "engines": {
+        "node": ">= 0.10.0"
+      }
+    },
     "node_modules/y18n": {
       "version": "5.0.8",
       "resolved": "https://registry.npmjs.org/y18n/-/y18n-5.0.8.tgz",

nodejs/package.json

@@ -1,7 +1,6 @@
 {
   "name": "t42-sso-manager",
-  "version": "1.1.15",
-  "private": true,
+  "version": "1.1.17",
   "author": [
     {
       "name": "William Mantly",
@@ -42,7 +41,8 @@
     "mustache": "^4.2.0",
     "nodemailer": "^9.0.0",
     "p2psub": "^0.2.0",
-    "socket.io": "^4.8.3"
+    "socket.io": "^4.8.3",
+    "xss": "^1.0.15"
   },
   "license": "MIT",
   "repository": {

nodejs/routes/docs.js

@@ -4,6 +4,7 @@ const fs = require('fs');
 const path = require('path');
 const router = require('express').Router();
 const {marked} = require('marked');
+const xss = require('xss');
 const conf = require('@simpleworkjs/conf');
 const buildInfo = require('../utils/build_info');
 const rateLimit = require('../middleware/rate_limit');
@@ -131,7 +132,7 @@ router.get('/:slug', function(req, res, next) {
 			docs: docList,
 			currentSlug: req.params.slug,
 			docTitle: doc.title,
-			docHtml: fixDocLinks(fixImagePaths(marked(content))),
+			docHtml: xss(fixDocLinks(fixImagePaths(marked(content)))),
 		});
 	} catch (error) {
 		next(error);

nodejs/routes/index.js

@@ -5,6 +5,7 @@ var express = require('express');
 var router = express.Router();
 const moment = require('moment');
 const {marked} = require('marked');
+const xss = require('xss');
 const {InviteToken, PasswordResetToken} = require('./../models/token');
 const {Tos} = require('../models/tos');
 const conf = require('@simpleworkjs/conf');
@@ -46,7 +47,7 @@ router.get('/health', function(req, res) {
 router.get('/tos', async function(req, res, next) {
   try {
     const tos = await Tos.getCurrent();
-    res.render('tos', {...values, tosHtml: marked(tos.content), tosUpdatedOnFmt: moment(tos.updated_on, 'x').format('MMMM YYYY')});
+    res.render('tos', {...values, tosHtml: xss(marked(tos.content)), tosUpdatedOnFmt: moment(tos.updated_on, 'x').format('MMMM YYYY')});
   } catch (error) {
     next(error);
   }
@@ -68,7 +69,7 @@ router.get('/invites', function(req, res) {
 router.get('/onboarding', async function(req, res, next) {
   try {
     const tos = await Tos.getCurrent();
-    res.render('onboarding', {...values, tosHtml: marked(tos.content)});
+    res.render('onboarding', {...values, tosHtml: xss(marked(tos.content))});
   } catch (error) {
     next(error);
   }
@@ -92,7 +93,14 @@ router.get('/login', async function(req, res, next) {
 // hardcoded in a doc, so they're always right for *this* deployment.
 router.get('/integrations', function(req, res, next) {
   const issuer = ((conf.oauth && conf.oauth.issuer) || `${req.protocol}://${req.get('host')}`).replace(/\/$/, '');
-  const ldapHost = issuer.replace(/^https?:\/\//, '').replace(/:\d+$/, '');
+  // The public-facing host (from the OAuth issuer). Used for OIDC links.
+  const issuerHost = issuer.replace(/^https?:\/\//, '').replace(/:\d+$/, '');
+
+  // The hostname advertised for direct LDAPS binds may be a separate,
+  // internal-only name so admins don't have to port-forward 636 publicly.
+  // Defaults to the issuer host to preserve prior behavior.
+  const ldapsHost = (conf.ldap && conf.ldap.ldapsHost) || issuerHost;
+  const ldapsPort = Number((conf.ldap && conf.ldap.ldapsPort) || 636) || 636;
 
   const userBase = (conf.ldap && conf.ldap.userBase) || 'ou=people,dc=example,dc=com';
   const groupBase = (conf.ldap && conf.ldap.groupBase) || 'ou=groups,dc=example,dc=com';
@@ -105,8 +113,9 @@ router.get('/integrations', function(req, res, next) {
     ...values,
     issuer,
     discoveryUrl: `${issuer}/.well-known/openid-configuration`,
-    ldapHost,
-    ldapsUrl: `ldaps://${ldapHost}:636`,
+    ldapHost: ldapsHost,
+    ldapsUrl: `ldaps://${ldapsHost}:${ldapsPort}`,
+    ldapsHostExplicit: !!(conf.ldap && conf.ldap.ldapsHost),
     baseDn,
     userBase,
     groupBase,

nodejs/tests/integrations.test.js

@@ -0,0 +1,47 @@
+'use strict';
+
+const request = require('supertest');
+const app = require('../app');
+const conf = require('@simpleworkjs/conf');
+
+const ORIG_LDAP = { ...conf.ldap };
+const ORIG_OAUTH = { ...(conf.oauth || {}) };
+
+function restoreConf() {
+  conf.ldap = { ...conf.ldap, ...ORIG_LDAP };
+  conf.oauth = { ...(conf.oauth || {}), ...ORIG_OAUTH };
+}
+
+beforeEach(() => {
+  // Start each test from a known state; the local secrets.js may set an issuer.
+  conf.ldap = { ...conf.ldap, ldapsHost: '', ldapsPort: 636 };
+  if (conf.oauth) conf.oauth.issuer = '';
+});
+
+afterAll(() => {
+  restoreConf();
+});
+
+describe('GET /integrations', () => {
+  test('renders and derives LDAPS URL from the request host by default', async () => {
+    const res = await request(app)
+      .get('/integrations')
+      .set('Host', 'sso.example.com');
+
+    expect(res.status).toBe(200);
+    expect(res.text).toContain('ldaps://sso.example.com:636');
+  });
+
+  test('uses conf.ldap.ldapsHost when set', async () => {
+    conf.ldap = { ...conf.ldap, ldapsHost: 'ldap.internal.example.com', ldapsPort: 1636 };
+
+    const res = await request(app)
+      .get('/integrations')
+      .set('Host', 'public.example.com');
+
+    expect(res.status).toBe(200);
+    expect(res.text).toContain('ldaps://ldap.internal.example.com:1636');
+    expect(res.text).not.toContain('ldaps://public.example.com:636');
+    expect(res.text).toContain('Custom <code>conf.ldap.ldapsHost</code>');
+  });
+});

nodejs/views/integrations.ejs

@@ -409,6 +409,46 @@
 	</p>
 
 	<div class="row g-3">
+		<div class="col-12">
+			<div class="card shadow-sm border-warning">
+				<div class="card-header bg-warning bg-opacity-10">
+					<i class="fa-solid fa-triangle-exclamation"></i>
+					LDAPS hostname: keep LDAP binds off the public internet
+				</div>
+				<div class="card-body">
+					<p class="small mb-2">
+						LDAPS requires a <strong>hostname</strong>, not a bare IP address, because
+						the TLS client verifies the server name against the certificate.
+						The URL below <% if (ldapsHostExplicit) { %>is set to <code><%= ldapHost %></code> from
+						<code>conf.ldap.ldapsHost</code>.<% } else { %>currently matches the public
+						OAuth issuer host — convenient, but that implies clients reach it through
+						your router on port 636. <strong>Do not port-forward 636 to the internet</strong>
+						for LDAP simple binds; instead pick an internal-only hostname and set
+						<code>conf.ldap.ldapsHost</code>.<% } %>
+					</p>
+					<ul class="small mb-2">
+						<li><strong>Same Docker/network host (recommended for the proxy or apps on this machine):</strong>
+							use <code>ldaps://sso-manager:636</code> (the internal service name).
+							Set <code>conf.ldap.ldapsHost = 'sso-manager'</code>.</li>
+						<li><strong>LAN host:</strong> create an internal DNS record like
+							<code>ldap.internal.example.com</code> → the local IP, get or generate a cert
+							whose SAN matches that name, and set <code>conf.ldap.ldapsHost</code>.
+							A wildcard for <code>*.internal.example.com</code> works well.</li>
+						<li><strong>Public hostname:</strong> only acceptable behind a VPN or firewall
+							lockdown — never exposed to the open internet.</li>
+					</ul>
+					<p class="small mb-0">
+						<b>Trusting the cert:</b> The bundled slapd uses a self-signed cert unless you
+						mount your own at <code>/etc/openldap/certs</code>. Clients must either trust
+						that cert, or set <code>TLS_REQCERT never</code> / <code>rejectUnauthorized: false</code>
+						for LAN-only use. See <a href="/docs/ldap">LDAP docs</a> for the full
+						runbook, including how to set <code>ldapsHost</code> in
+						<code>conf/secrets.js</code> or via <code>app_ldap__ldapsHost=...</code>.
+					</p>
+				</div>
+			</div>
+		</div>
+
 		<div class="col-lg-6">
 			<div class="card shadow-lg">
 				<div class="card-header shadow">
@@ -428,6 +468,11 @@
 								<input type="text" id="f-ldapsUrl" class="form-control font-monospace" readonly value="<%= ldapsUrl %>">
 								<button class="btn btn-outline-secondary" type="button" onclick="copyField('f-ldapsUrl', this)" title="Copy"><i class="fa-solid fa-copy"></i></button>
 							</div>
+							<% if (ldapsHostExplicit) { %>
+							<small class="field-help text-muted d-block">
+								Custom <code>conf.ldap.ldapsHost</code> — override in your secrets file if this name doesn't resolve from the client.
+							</small>
+							<% } %>
 						</dd>
 
 						<dt class="col-sm-4">Base DN</dt>
@@ -522,6 +567,8 @@
 			'git clone https://github.com/theta42/ldap-client.git',
 			'cd ldap-client',
 			'cat > ldap.vars << \'EOF\'',
+			'# LDAPS host advertised on the Integrations page. If this is an internal-only',
+			'# hostname, make sure it resolves from this host and the cert SAN matches it.',
 			'export ldap_host="<%= ldapHost %>"',
 			'export ldap_base_dn="<%= baseDn %>"',
 			'',

secrets.js.example

@@ -30,6 +30,10 @@ module.exports = {
         bindPassword: 'your-ldap-password',
         userBase: 'ou=people,dc=example,dc=com',
         groupBase: 'ou=groups,dc=example,dc=com',
+        // ldapsHost: 'ldap.internal.example.com', // optional: hostname shown for
+        // direct LDAPS binds on /integrations. Leave empty to derive from the
+        // OAuth issuer. Set an internal-only name to avoid port-forwarding 636.
+        // ldapsPort: 636,
     },
     smtp: {
         host: 'smtp.example.com',