Merge pull request #90 from theta42/feature/multi-master-ldap-location

feat: N-Way Multi-Master LDAP & User Location

.github/workflows/pr-tests.yml

@@ -136,6 +136,10 @@ jobs:
           # directory layout (dc=example,dc=com) -- only the admin password
           # (normally supplied via a gitignored secrets.js) needs setting.
           app_ldap__bindPassword: your-ldap-password
+          # routes/oauth.js now refuses to start without a real jwtSecret.
+          # This is a non-secret test value; the container under test uses
+          # secrets.js.example's jwtSecret independently.
+          app_oauth__jwtSecret: ci-test-jwt-secret-do-not-use-in-production
         run: npm test
 
   test-summary:

CHANGELOG.md

@@ -6,6 +6,34 @@ correspond to git tags (`vX.Y.Z`) and `nodejs/package.json`'s `version`.
 
 ## [Unreleased]
 
+## [1.1.17] - 2026-07-18
+
+### Added
+- `conf.ldap.ldapsHost` and `conf.ldap.ldapsPort` config options (also settable via `app_ldap__ldapsHost` / `app_ldap__ldapsPort`). When `ldapsHost` is set, the `/integrations` page advertises that hostname for direct LDAPS binds instead of deriving it from the public OAuth issuer. This lets operators use an internal-only hostname (e.g. `ldap.internal.example.com` or `sso-manager` on the Docker network) and avoid port-forwarding 636 to the internet.
+- A contextual help panel on `/integrations` → LDAP explaining why LDAPS needs a hostname (not an IP), why 636 should not be publicly forwarded, and the recommended internal-DNS / Docker-internal alternatives.
+
+### Changed
+- `routes/index.js` now computes the displayed LDAPS URL from `conf.ldap.ldapsHost`/`ldapsPort` with fallback to the OAuth issuer host for backward compatibility.
+- `secrets.js.example`, `docs/configuration.md`, `docs/ldap.md`, and `DEPLOYMENT.md` document the new `ldapsHost`/`ldapsPort` options and recommended network layouts.
+- Bumped version to `1.1.17` in `nodejs/package.json`.
+
+## [1.1.16] - 2026-07-18
+
+### Security
+- Hardened LDAP filter and DN construction against injection. All user-supplied values interpolated into group filters (`models/group_ldap.js`) and RDN values used when adding users/groups (`models/user_ldap.js`) are now escaped before being sent to the LDAP server.
+- Replaced `Math.random()`-based token generation in `models/token.js`, `models/oauth_code.js`, and `models/oauth_client.js` with `crypto.randomUUID()` for session tokens, OAuth codes, access/refresh tokens, and client IDs.
+- Replaced `Math.random()`-based OTP generation in `OtpToken.issue()` with `crypto.randomInt()`.
+- `routes/oauth.js` now refuses to start if `oauth.jwtSecret` is missing or still set to the placeholder value, instead of falling back to a hardcoded public string.
+- Rendered docs and Terms-of-Service HTML in `routes/docs.js` and `routes/index.js` are now sanitized with `xss` to prevent stored XSS from malicious markdown.
+- Removed a `console.log` that wrote new-user data (including password hashes) to the log in `models/user_ldap.js`; reduced login-path error logging to `error.name`/`error.message` only.
+
+### Changed
+- Public-release packaging: removed `"private": true` from `nodejs/package.json` and bumped version to `1.1.16`.
+- CI workflow (`.github/workflows/pr-tests.yml`) now sets `app_oauth__jwtSecret` so the test suite can run against the new startup-time JWT validation.
+
+### Fixed
+- `models/email.js`: fixed a template bug where the rendered `from` address used `template.message` instead of `template.from`.
+
 ## [1.1.15] - 2026-07-18
 
 ### Changed
@@ -116,7 +144,7 @@ First tagged release. Establishes the `vX.Y.Z` tag convention that the in-app up
 - Unix/POSIX and LDAP bind-only service account support, distinct from real-person accounts.
 - Merged OAuth Apps + LDAP Info into a single Integrations page.
 
-[Unreleased]: https://github.com/theta42/sso-manager-node/compare/v1.1.15...HEAD
+[Unreleased]: https://github.com/theta42/sso-manager-node/compare/v1.1.16...HEAD
 [1.1.15]: https://github.com/theta42/sso-manager-node/compare/v1.1.14...v1.1.15
 [1.1.14]: https://github.com/theta42/sso-manager-node/compare/v1.1.13...v1.1.14
 [1.1.13]: https://github.com/theta42/sso-manager-node/compare/v1.1.12...v1.1.13

DEPLOYMENT.md

@@ -176,6 +176,8 @@ docker compose exec sso-manager ldapsearch -x -H ldap://localhost:389 \
 | `PORT` | `3001` | host port mapped to the UI |
 | `LDAPS_PORT` | `636` | host port mapped to LDAPS |
 | `LDAP_PORT` | `389` | uncomment the host mapping in compose to expose plain LDAP (not recommended) |
+| `LDAP_SERVER_ID` | empty | Unique integer ID (e.g. 1, 2) required to enable Multi-Master replication |
+| `LDAP_REPLICATION_HOSTS` | empty | Space-separated list of other sites' LDAP URLs for replication (e.g. `ldaps://site2:636`) |
 
 Any `app_*` var may also be set directly to override any config value (see the
 table at the top).
@@ -188,6 +190,12 @@ valid 10 years, SAN includes the CN + `localhost` + `127.0.0.1`) and listens on
 `ldap-certs` volume so it persists across container recreation — clients don't need
 to re-trust on every rebuild.
 
+The `/integrations` page derives its LDAPS URL from the OAuth issuer by default.
+To advertise a separate, internal-only hostname (e.g. `ldap.internal.example.com`
+or `sso-manager` for Docker-internal clients), set `conf.ldap.ldapsHost` in your
+secrets file or pass `app_ldap__ldapsHost=...`. See `docs/ldap.md` for
+recommended network layouts and how to match the cert SAN to the hostname.
+
 - **Trusting the self-signed cert** (clients): copy `/etc/openldap/certs/ldap.crt`
   out of the container and add it to the client's trusted CA store, or set
   `TLS_REQCERT never` for quick-and-dirty LAN use. Fetch it with:

Dockerfile.openldap

@@ -55,6 +55,7 @@ RUN apk add --no-cache \
     openldap-overlay-ppolicy \
     openldap-overlay-memberof \
     openldap-overlay-refint \
+    openldap-overlay-syncprov \
     openldap-passwd-sha2 \
     dumb-init \
     bash \

README.md

@@ -44,6 +44,7 @@ phone-home, no hosted control plane, and no per-user pricing.
   drive the management API from scripts or CI, scoped to their own permissions.
 - **All-in-one Docker image** — app + OpenLDAP + Redis in one container, or run
   the pieces separately against your own LDAP/Redis via `app_*` env config.
+- **Multi-Site Support (Geo-Location Scaling)** — built-in support for N-Way Multi-Master OpenLDAP replication across physical sites for HA and low latency.
 
 ## Why this over the alternatives
 

docker-compose.repl-test.yml

@@ -0,0 +1,36 @@
+services:
+  site1:
+    build: .
+    container_name: sso_site1
+    environment:
+      - LDAP_SERVER_ID=1
+      - LDAP_REPLICATION_HOSTS=ldap://site2:389
+      - LDAP_BASE_DN=dc=test,dc=local
+      - LDAP_ADMIN_PASS=secret
+    ports:
+      - "3001:3001"
+      - "10389:389"
+    volumes:
+      - site1-ldap:/var/lib/ldap
+      - site1-redis:/data
+
+  site2:
+    build: .
+    container_name: sso_site2
+    environment:
+      - LDAP_SERVER_ID=2
+      - LDAP_REPLICATION_HOSTS=ldap://site1:389
+      - LDAP_BASE_DN=dc=test,dc=local
+      - LDAP_ADMIN_PASS=secret
+    ports:
+      - "3002:3001"
+      - "20389:389"
+    volumes:
+      - site2-ldap:/var/lib/ldap
+      - site2-redis:/data
+
+volumes:
+  site1-ldap:
+  site1-redis:
+  site2-ldap:
+  site2-redis:

docker-entrypoint.sh

@@ -125,6 +125,8 @@ include         /etc/openldap/schema/theta42.schema
 include         /etc/openldap/schema/sudo.schema
 include         /etc/openldap/schema/openssh-lpk.schema
 
+SERVER_ID_PLACEHOLDER
+
 # Module loading (pw-sha2 provides {SSHA512} used by the app for user passwords;
 # ppolicy/memberof/refint are the overlays the app depends on). On OpenLDAP 2.5+
 # the ppolicy schema (pwdPolicy, pwdAccountLockedTime, ...) is built into
@@ -137,6 +139,7 @@ moduleload      pw-sha2
 moduleload      ppolicy
 moduleload      memberof
 moduleload      refint
+SYNCPROV_MODULE_PLACEHOLDER
 
 # TLS (LDAPS on 636 + StartTLS on 389). Cert/key paths are fixed; the files are
 # generated/mounted above. We accept clients without their own cert (the common
@@ -184,6 +187,8 @@ memberof-memberof-ad memberOf
 overlay         refint
 refint_attributes memberOf member manager owner
 
+REPLICATION_BLOCK_PLACEHOLDER
+
 # Access controls
 access to attrs=userPassword
     by dn="BIND_DN_PLACEHOLDER" write
@@ -211,6 +216,30 @@ else
     sed -i "/^SLAPMODULEPATH$/d" /etc/openldap/slapd.conf
 fi
 
+# ── Multi-Master Replication Configuration ──
+if [[ -n "${LDAP_SERVER_ID:-}" && -n "${LDAP_REPLICATION_HOSTS:-}" ]]; then
+    info "Configuring Multi-Master replication (Server ID: ${LDAP_SERVER_ID})"
+    sed -i "s|^SERVER_ID_PLACEHOLDER|ServerID ${LDAP_SERVER_ID}|" /etc/openldap/slapd.conf
+    sed -i "s|^SYNCPROV_MODULE_PLACEHOLDER|moduleload      syncprov|" /etc/openldap/slapd.conf
+    
+    # Generate syncrepl blocks
+    REPL_BLOCK="overlay syncprov\nsyncprov-checkpoint 100 10\nsyncprov-sessionlog 100\n\n"
+    RID=100
+    for HOST in ${LDAP_REPLICATION_HOSTS}; do
+        RID=$((RID + 1))
+        REPL_BLOCK="${REPL_BLOCK}syncrepl rid=${RID}\n  provider=${HOST}\n  type=refreshAndPersist\n  retry=\"60 +\"\n  searchbase=\"${LDAP_BASE_DN}\"\n  bindmethod=simple\n  binddn=\"${LDAP_BIND_DN}\"\n  credentials=\"${LDAP_ADMIN_PASS}\"\n\n"
+    done
+    REPL_BLOCK="${REPL_BLOCK}mirrormode on\n"
+    
+    # Replace placeholder (awk is safer for multiline replacements than sed)
+    awk -v repl="$(printf '%b' "$REPL_BLOCK")" '{gsub(/REPLICATION_BLOCK_PLACEHOLDER/, repl)}1' /etc/openldap/slapd.conf > /etc/openldap/slapd.conf.tmp
+    mv /etc/openldap/slapd.conf.tmp /etc/openldap/slapd.conf
+else
+    sed -i "/^SERVER_ID_PLACEHOLDER/d" /etc/openldap/slapd.conf
+    sed -i "/^SYNCPROV_MODULE_PLACEHOLDER/d" /etc/openldap/slapd.conf
+    sed -i "/^REPLICATION_BLOCK_PLACEHOLDER/d" /etc/openldap/slapd.conf
+fi
+
 chown ldap:ldap /etc/openldap/slapd.conf 2>/dev/null || true
 chown -R ldap:ldap /var/lib/ldap 2>/dev/null || true
 

docs/configuration.md

@@ -32,6 +32,8 @@ raw strings otherwise.
 | `app_ldap__userBase=ou=people,dc=…` | `conf.ldap.userBase` | string |
 | `app_ldap__uidGidMin=1500` | `conf.ldap.uidGidMin` | number (new-user id floor) |
 | `app_ldap__uidGidReservedFloor=9000` | `conf.ldap.uidGidReservedFloor` | number (ids at/above this are ignored when allocating) |
+| `app_ldap__ldapsHost=ldap.internal.example.com` | `conf.ldap.ldapsHost` | string (hostname shown on `/integrations` for LDAPS binds; empty = derive from `oauth.issuer`) |
+| `app_ldap__ldapsPort=636` | `conf.ldap.ldapsPort` | number (port shown on `/integrations`) |
 | `app_oauth__jwtSecret=...` | `conf.oauth.jwtSecret` | string |
 | `app_oauth__issuer=https://sso.example.com` | `conf.oauth.issuer` | string |
 | `app_oauth__token_lifetime__access_token=3600` | `conf.oauth.token_lifetime.access_token` | number |

docs/index.md

@@ -56,6 +56,7 @@ backend, that's the niche.
   Emby, …) uses LDAPS/StartTLS against the same directory.
 - **All-in-one Docker image** — app + OpenLDAP + Redis in one container, or
   run the pieces separately via `app_*` env config.
+- **Geo-Location Scaling** — built-in support for N-Way Multi-Master OpenLDAP [replication](replication.html) across physical sites.
 
 ## Get it
 

docs/ldap.md

@@ -118,6 +118,81 @@ volumes:
 
 The entrypoint leaves existing certs untouched (idempotent).
 
+## Choosing the LDAPS hostname
+
+The `/integrations` page advertises an **LDAPS URL** for direct LDAP binds. By
+default it derives that URL from the public OAuth issuer (e.g.
+`https://sso.example.com` → `ldaps://sso.example.com:636`). That is convenient,
+but it implies LDAP clients reach your directory through the same public
+hostname — which usually means port-forwarding 636 through your router.
+
+**Do not port-forward LDAPS (636) to the public internet.** LDAP simple binds
+have no rate limiting and are a brute-force target. Instead, use one of these
+internal-only patterns and set `conf.ldap.ldapsHost` (or
+`app_ldap__ldapsHost`) so the `/integrations` page shows the right URL.
+
+### 1. Same Docker / local network host (best for apps on this machine)
+
+If the LDAP client runs on the same Docker network as the SSO Manager (for
+example, the bundled `theta-env` stack), use the internal service name:
+
+```
+ldaps://sso-manager:636
+```
+
+In `conf/secrets.js`:
+
+```javascript
+ldap: {
+  ldapsHost: 'sso-manager',
+  ldapsPort: 636,
+}
+```
+
+The proxy in theta-env already uses this internally. The bundled slapd cert
+includes `sso-manager` in its SAN when `LDAP_CERT_CN` is left at its default,
+so hostname verification works without extra setup.
+
+### 2. LAN host behind your router (best for separate home-lan machines)
+
+Create an internal-only DNS record — e.g. `ldap.internal.example.com` →
+`192.168.1.10` — using your router, Pi-hole, or a local `hosts` file. Then get
+or generate a cert whose SAN/CN matches that internal name:
+
+- **Let's Encrypt wildcard** (`*.internal.example.com`) works if you own the
+  public domain and can complete DNS-01 challenge; the record itself can stay
+  private/routable only inside your LAN.
+- **Internal CA** is fine for a pure LAN: run a small CA, issue a cert for
+  `ldap.internal.example.com`, and distribute the CA cert to clients.
+- **Self-signed** with `LDAP_CERT_CN=ldap.internal.example.com` also works; copy
+  the generated `ldap.crt` to each client and trust it.
+
+In `conf/secrets.js`:
+
+```javascript
+ldap: {
+  ldapsHost: 'ldap.internal.example.com',
+  ldapsPort: 636,
+}
+```
+
+The URL on `/integrations` becomes `ldaps://ldap.internal.example.com:636`.
+
+### 3. Public hostname (acceptable only behind a VPN/firewall)
+
+If a remote host must bind LDAP, put it behind a VPN (Tailscale, WireGuard,
+etc.) or a tightly locked-down firewall rule. In that case the public hostname
+may be appropriate, but the LDAPS port should still not be reachable from the
+open internet.
+
+### Why not just use the LDAP server's IP address?
+
+TLS clients verify the server name against the certificate. Connecting to
+`ldaps://192.168.1.10:636` with a cert issued for `*.internal.example.com`
+will fail hostname verification unless you disable cert checks — which removes
+most of the security benefit of LDAPS. Always use a hostname that matches the
+cert.
+
 ## Service accounts
 
 A service account is a normal `posixAccount` for something that isn't a

docs/replication.md

@@ -0,0 +1,55 @@
+---
+layout: default
+title: Geo-Location Scaling (Replication)
+---
+
+# Geo-Location Scaling (Replication)
+
+SSO Manager is built to be a self-contained identity provider, but if you have multiple physical sites, you may want a local copy of the directory at each site to ensure low latency and high availability.
+
+## Why and when to use this?
+- **High Availability (HA)**: If your primary site goes completely offline, your other sites can still authenticate users locally without depending on a WAN link.
+- **Low Latency**: Applications at a remote site can bind directly to their local LDAP server (`localhost` or LAN IP) instead of traversing the internet to query the primary site, making logins blazing fast.
+- **Independent Failure Domains**: By replicating only the LDAP directory (the source of truth) and keeping session state (Redis) independent, you prevent complex "split-brain" scenarios in the web UI. A failure at Site A won't bring down Site B.
+
+By default, the `sso-manager` Docker container runs a single, independent OpenLDAP instance. However, you can enable **N-Way Multi-Master Replication** via environment variables.
+
+## How it works
+
+In an N-Way Multi-Master setup, every site runs a fully active OpenLDAP server (`slapd`).
+- **Reads and Writes anywhere**: A user can change their password or update their profile at Site A, Site B, or Site C.
+- **Conflict Resolution**: OpenLDAP's `syncrepl` engine uses Context Sequence Numbers (CSN) to track changes. If Site A goes offline and a user changes their password at Site B, Site A will automatically pull the newest changes the moment it rejoins the cluster.
+- **Independent Redis**: Session data, API Tokens, and OAuth Clients are stored in Redis. By design, Redis is NOT replicated in this geographic setup. This ensures that a failure at Site A never causes Site B's Redis to become read-only, which would break the web UI at Site B. OAuth clients must be configured per-site.
+
+## Configuration
+
+To enable replication, you must pass two environment variables to the `sso-manager` container:
+
+1. `LDAP_SERVER_ID`: A unique integer for this node (e.g., `1`, `2`, `3`). This MUST be unique across the cluster.
+2. `LDAP_REPLICATION_HOSTS`: A space-separated list of the LDAP URLs of all **other** nodes in the cluster.
+
+### Example using `theta-env` / Docker Compose
+
+**Site 1 (`setup.env` or `docker-compose.yml`)**
+```env
+LDAP_SERVER_ID=1
+LDAP_REPLICATION_HOSTS="ldaps://sso.site2.com:636 ldaps://sso.site3.com:636"
+```
+
+**Site 2 (`setup.env` or `docker-compose.yml`)**
+```env
+LDAP_SERVER_ID=2
+LDAP_REPLICATION_HOSTS="ldaps://sso.site1.com:636 ldaps://sso.site3.com:636"
+```
+
+**Site 3 (`setup.env` or `docker-compose.yml`)**
+```env
+LDAP_SERVER_ID=3
+LDAP_REPLICATION_HOSTS="ldaps://sso.site1.com:636 ldaps://sso.site2.com:636"
+```
+
+Once configured, the container's entrypoint will automatically load the `syncprov` module, enable `mirrormode`, and generate the necessary `syncrepl` blocks in `/etc/openldap/slapd.conf`.
+
+## User Locations
+
+When creating or editing a user, you can specify their **Location (Site)**. This maps directly to the standard LDAP `l` (localityName) attribute, allowing you to track which physical site a user belongs to natively within the directory.

nodejs/conf/base.js

@@ -22,6 +22,13 @@ module.exports = {
 		groupBase: 'ou=groups,dc=example,dc=com',
 		userFilter: '(objectClass=posixAccount)',
 		userNameAttribute: 'uid',
+		// Hostname/port advertised on the /integrations page for direct-LDAP
+		// clients. Leave ldapsHost empty to derive it from the OAuth issuer host.
+		// Set it to an internal-only name (e.g. 'ldap.internal.example.com' or
+		// 'sso-manager' on the Docker network) so external clients don't need a
+		// public 636 port forward. See docs/ldap.md.
+		ldapsHost: '',
+		ldapsPort: 636,
 		// New users/personal groups (see addPosixAccount/addPosixGroup in
 		// models/user_ldap.js) get the next uid/gidNumber >= uidGidMin.
 		// Existing entries >= uidGidReservedFloor are ignored when computing

nodejs/models/auth.js

@@ -23,7 +23,7 @@ Auth.login = async function(data){
 
 		return {user, token}
 	}catch(error){
-		console.error("AUTH LOGIN error:", error);
+		console.error("AUTH LOGIN error:", error.name, error.message);
 		throw this.errors.login();
 	}
 };

nodejs/models/email.js

@@ -58,7 +58,7 @@ Mail.sendTemplate = async function(to, template, context, from){
 		to,
 		mustache.render(template.subject, context),
 		mustache.render(template.message, context),
-		from || (template.from && mustache.render(template.message, context))
+		from || (template.from && mustache.render(template.from, context))
 	)
 };
 

nodejs/models/group_ldap.js

@@ -4,6 +4,31 @@ const { Client, Attribute, Change } = require('ldapts');
 const { LRUCache } = require('lru-cache');
 const conf = require('@simpleworkjs/conf').ldap;
 
+// Escape a value used inside an LDAP search filter (RFC 4515).
+function escapeLDAPSearchValue(val) {
+	return String(val)
+		.replace(/\\/g, '\\5c')
+		.replace(/\*/g, '\\2a')
+		.replace(/\(/g, '\\28')
+		.replace(/\)/g, '\\29')
+		.replace(/\0/g, '\\00');
+}
+
+// Escape a value used in an LDAP DN (RFC 4514). Defensive: usernames/cns
+// are normally alphanumeric, but this prevents metacharacter injection.
+function escapeLDAPDNValue(val) {
+	return String(val)
+		.replace(/\\/g, '\\\\')
+		.replace(/,/g, '\\,')
+		.replace(/\+/g, '\\+')
+		.replace(/"/g, '\\"')
+		.replace(/</g, '\\<')
+		.replace(/>/g, '\\>')
+		.replace(/;/g, '\\;')
+		.replace(/=/g, '\\=')
+		.replace(/^\s|\s$/g, match => match === ' ' ? '\\ ' : match);
+}
+
 function makeClient() {
 	return new Client({ url: conf.url });
 }
@@ -19,7 +44,7 @@ async function withClient(fn) {
 }
 
 async function getGroups(client, member){
-	let memberFilter = member ? `(member=${member})`: ''
+	let memberFilter = member ? `(member=${escapeLDAPSearchValue(member)})`: ''
 
 	let groups = (await client.search(conf.groupBase, {
 		scope: 'sub',
@@ -35,7 +60,8 @@ async function getGroups(client, member){
 }
 
 async function addGroup(client, data){
-	await client.add(`cn=${data.name},${conf.groupBase}`, {
+	const safeName = escapeLDAPDNValue(data.name);
+	await client.add(`cn=${safeName},${conf.groupBase}`, {
 		cn: data.name,
 		member: data.owner,
 		description: data.description,
@@ -139,9 +165,10 @@ Group.get = async function(data){
 	}
 
 	return withClient(async (client) => {
+		const safeName = escapeLDAPSearchValue(data.name);
 		let group = (await client.search(conf.groupBase, {
 			scope: 'sub',
-			filter: `(&(objectClass=groupOfNames)(cn=${data.name}))`,
+			filter: `(&(objectClass=groupOfNames)(cn=${safeName}))`,
 			attributes: ['cn', 'description', 'member', 'owner', 'createTimestamp', 'modifyTimestamp'],
 		})).searchEntries[0];
 

nodejs/models/oauth_client.js

@@ -2,7 +2,8 @@
 
 const Table = require('.');
 const bcrypt = require('bcrypt');
-const UUID = function b(a){return a?(a^Math.random()*16>>a/4).toString(16):([1e7]+-1e3+-4e3+-8e3+-1e11).replace(/[018]/g,b)};
+const crypto = require('crypto');
+const UUID = () => crypto.randomUUID();
 const conf = require('@simpleworkjs/conf');
 
 const defaultLifetime = (conf.oauth && conf.oauth.token_lifetime) || {

nodejs/models/oauth_code.js

@@ -1,7 +1,8 @@
 'use strict';
 
 const Table = require('.');
-const UUID = function b(a){return a?(a^Math.random()*16>>a/4).toString(16):([1e7]+-1e3+-4e3+-8e3+-1e11).replace(/[018]/g,b)};
+const crypto = require('crypto');
+const UUID = () => crypto.randomUUID();
 
 // Shared base keyMap matching Token's schema so these behave as tokens
 const tokenKeyMap = {

nodejs/models/token.js

@@ -1,7 +1,8 @@
 'use strict';
 
 const Table = require('.');
-const UUID = function b(a){return a?(a^Math.random()*16>>a/4).toString(16):([1e7]+-1e3+-4e3+-8e3+-1e11).replace(/[018]/g,b)};
+const crypto = require('crypto');
+const UUID = () => crypto.randomUUID();
 
 
 class Token extends Table{
@@ -110,7 +111,7 @@ class OtpToken extends Token {
 		for (const t of existing) {
 			if (t.is_valid) await t.update({is_valid: false});
 		}
-		const code = String(Math.floor(100000 + Math.random() * 900000));
+		const code = String(crypto.randomInt(100000, 1000000));
 		return this.create({uid, code, method, created_by: uid});
 	}
 

nodejs/models/user_ldap.js

@@ -45,6 +45,20 @@ function escapeLDAPSearchValue(val) {
               .replace(/\0/g, '\\00');
 }
 
+// Escape a value used in an LDAP DN (RFC 4514).
+function escapeLDAPDNValue(val) {
+	return String(val)
+		.replace(/\\/g, '\\\\')
+		.replace(/,/g, '\\,')
+		.replace(/\+/g, '\\+')
+		.replace(/"/g, '\\"')
+		.replace(/</g, '\\<')
+		.replace(/>/g, '\\>')
+		.replace(/;/g, '\\;')
+		.replace(/=/g, '\\=')
+		.replace(/^\s|\s$/g, match => match === ' ' ? '\\ ' : match);
+}
+
 // Compute the next available uid/gidNumber: the highest existing value below
 // conf.uidGidReservedFloor, plus one -- or conf.uidGidMin if there are no
 // such entries yet. Entries at/above the reserved floor (e.g. a bootstrap
@@ -72,7 +86,8 @@ async function addPosixGroup(client, data){
 
 	data.gidNumber = nextPosixId(groups, 'gidNumber');
 
-	await client.add(`cn=${data.cn},${conf.groupBase}`, {
+	const safeCn = escapeLDAPDNValue(data.cn);
+	await client.add(`cn=${safeCn},${conf.groupBase}`, {
 	  cn: data.cn,
 	  gidNumber: data.gidNumber,
 	  objectclass: [ 'posixGroup', 'top' ]
@@ -94,6 +109,7 @@ async function addPosixAccount(client, data){
 
 	data.uidNumber = nextPosixId(people, 'uidNumber');
 
+	const safeCn = escapeLDAPDNValue(data.cn);
 	const entry = {
 		cn: data.cn,
 		sn: data.sn,
@@ -130,6 +146,10 @@ async function addPosixAccount(client, data){
 		entry.dateOfBirth = data.dob;
 	}
 
+	if (data.location) {
+		entry.l = data.location;
+	}
+
 	// userPassword is optional -- a service account with no password set
 	// simply can't bind (no special enforcement needed, that's the default
 	// LDAP simple-bind behavior for an entry lacking the attribute).
@@ -143,7 +163,7 @@ async function addPosixAccount(client, data){
 		entry.manager = [].concat(data.manager);
 	}
 
-	await client.add(`cn=${data.cn},${conf.userBase}`, entry);
+	await client.add(`cn=${safeCn},${conf.userBase}`, entry);
 
 	return data
 
@@ -171,7 +191,6 @@ async function addLdapUser(client, data){
 			delete data.userPassword;
 		}
 
-		console.log('addLdapUser', data)
 		group = await addPosixGroup(client, data);
 		data = await addPosixAccount(client, group);
 
@@ -206,6 +225,7 @@ const user_parse = function(data){
 		data.username = data[conf.userNameAttribute]
 		data.userPassword = undefined;
 	}
+	data.location = data.l ? String(data.l) : '';
 	// Use truthy strings so jq-repeat section blocks ({{#isActive}}) fire correctly
 	data.isActive   = data.pwdAccountLockedTime ? '' : 'active';
 	data.isInactive = data.pwdAccountLockedTime ? 'inactive' : '';
@@ -504,6 +524,16 @@ User.update = async function(data){
 				this.dateOfBirth = data.dateOfBirth;
 			}
 
+			if(data.location !== undefined){
+				await client.modify(this.dn, [
+					new Change({
+						operation: 'replace',
+						modification: new Attribute({ type: 'l', values: [data.location] }),
+					}),
+				]);
+				this.location = data.location;
+			}
+
 			if(data.manager !== undefined){
 				// Client sends uids; resolve each to a DN before writing --
 				// manager (COSINE, SUP distinguishedName) stores DNs, not uids.
@@ -799,7 +829,7 @@ User.addSSHkey = async function(data) {
 // memberUid (RFC 2307, posixGroup) is a bare username, not a DN, unlike
 // groupOfNames' `member` used by app_sso_* groups in group_ldap.js.
 function personalGroupDN(uid){
-	return `cn=${uid},${conf.groupBase}`;
+	return `cn=${escapeLDAPDNValue(uid)},${conf.groupBase}`;
 }
 
 User.getPersonalGroupMembers = async function(uid) {
@@ -873,7 +903,7 @@ User.login = async function(data){
 		return user;
 
 	}catch(error){
-		console.error("USER LOGIN error:", error);
+		console.error("USER LOGIN error:", error.name, error.message);
 		throw error;
 	}
 };

nodejs/package-lock.json

@@ -1,17 +1,17 @@
 {
   "name": "t42-sso-manager",
-  "version": "1.1.15",
+  "version": "1.1.17",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "t42-sso-manager",
-      "version": "1.1.15",
+      "version": "1.1.17",
       "license": "MIT",
       "dependencies": {
         "@fortawesome/fontawesome-free": "^7.3.0",
         "@popperjs/core": "^2.11.8",
-        "@simpleworkjs/conf": "^1.1.0",
+        "@simpleworkjs/conf": "^1.2.0",
         "bcrypt": "^6.0.0",
         "bootstrap": "^5.3.8",
         "compression": "^1.8.1",
@@ -19,7 +19,7 @@
         "express": "^5.2.1",
         "express-rate-limit": "^8.5.2",
         "extend": "^3.0.2",
-        "jq-repeat": "^2.1.0",
+        "jq-repeat": "^2.2.0",
         "jquery": "^3.7.1",
         "jsonwebtoken": "^9.0.3",
         "ldapts": "^8.1.2",
@@ -30,7 +30,8 @@
         "mustache": "^4.2.0",
         "nodemailer": "^9.0.0",
         "p2psub": "^0.2.0",
-        "socket.io": "^4.8.3"
+        "socket.io": "^4.8.3",
+        "xss": "^1.0.15"
       },
       "devDependencies": {
         "jest": "^30.4.2",
@@ -2331,6 +2332,12 @@
         "node": ">= 0.8"
       }
     },
+    "node_modules/commander": {
+      "version": "2.20.3",
+      "resolved": "https://registry.npmjs.org/commander/-/commander-2.20.3.tgz",
+      "integrity": "sha512-GpVkmM8vF2vQUkj2LvZmD35JxeJOLCwJ9cUkugyk2nuhbv3+mJvpLYYt+0+USMxE+oj+ey/lJEnhZw75x/OMcQ==",
+      "license": "MIT"
+    },
     "node_modules/component-emitter": {
       "version": "1.3.1",
       "resolved": "https://registry.npmjs.org/component-emitter/-/component-emitter-1.3.1.tgz",
@@ -2488,6 +2495,12 @@
         "node": ">= 8"
       }
     },
+    "node_modules/cssfilter": {
+      "version": "0.0.10",
+      "resolved": "https://registry.npmjs.org/cssfilter/-/cssfilter-0.0.10.tgz",
+      "integrity": "sha512-FAaLDaplstoRsDR8XGYH51znUN0UY7nMc6Z9/fvE8EXGwvJE9hu7W2vHwx1+bd6gCYnln9nLbzxFTrcO9YQDZw==",
+      "license": "MIT"
+    },
     "node_modules/debug": {
       "version": "4.4.3",
       "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
@@ -6488,6 +6501,22 @@
         }
       }
     },
+    "node_modules/xss": {
+      "version": "1.0.15",
+      "resolved": "https://registry.npmjs.org/xss/-/xss-1.0.15.tgz",
+      "integrity": "sha512-FVdlVVC67WOIPvfOwhoMETV72f6GbW7aOabBC3WxN/oUdoEMDyLz4OgRv5/gck2ZeNqEQu+Tb0kloovXOfpYVg==",
+      "license": "MIT",
+      "dependencies": {
+        "commander": "^2.20.3",
+        "cssfilter": "0.0.10"
+      },
+      "bin": {
+        "xss": "bin/xss"
+      },
+      "engines": {
+        "node": ">= 0.10.0"
+      }
+    },
     "node_modules/y18n": {
       "version": "5.0.8",
       "resolved": "https://registry.npmjs.org/y18n/-/y18n-5.0.8.tgz",

nodejs/package.json

@@ -1,7 +1,6 @@
 {
   "name": "t42-sso-manager",
-  "version": "1.1.15",
-  "private": true,
+  "version": "1.1.17",
   "author": [
     {
       "name": "William Mantly",
@@ -42,7 +41,8 @@
     "mustache": "^4.2.0",
     "nodemailer": "^9.0.0",
     "p2psub": "^0.2.0",
-    "socket.io": "^4.8.3"
+    "socket.io": "^4.8.3",
+    "xss": "^1.0.15"
   },
   "license": "MIT",
   "repository": {

nodejs/routes/docs.js

@@ -4,6 +4,7 @@ const fs = require('fs');
 const path = require('path');
 const router = require('express').Router();
 const {marked} = require('marked');
+const xss = require('xss');
 const conf = require('@simpleworkjs/conf');
 const buildInfo = require('../utils/build_info');
 const rateLimit = require('../middleware/rate_limit');
@@ -131,7 +132,7 @@ router.get('/:slug', function(req, res, next) {
 			docs: docList,
 			currentSlug: req.params.slug,
 			docTitle: doc.title,
-			docHtml: fixDocLinks(fixImagePaths(marked(content))),
+			docHtml: xss(fixDocLinks(fixImagePaths(marked(content)))),
 		});
 	} catch (error) {
 		next(error);

nodejs/routes/index.js

@@ -5,6 +5,7 @@ var express = require('express');
 var router = express.Router();
 const moment = require('moment');
 const {marked} = require('marked');
+const xss = require('xss');
 const {InviteToken, PasswordResetToken} = require('./../models/token');
 const {Tos} = require('../models/tos');
 const conf = require('@simpleworkjs/conf');
@@ -46,7 +47,7 @@ router.get('/health', function(req, res) {
 router.get('/tos', async function(req, res, next) {
   try {
     const tos = await Tos.getCurrent();
-    res.render('tos', {...values, tosHtml: marked(tos.content), tosUpdatedOnFmt: moment(tos.updated_on, 'x').format('MMMM YYYY')});
+    res.render('tos', {...values, tosHtml: xss(marked(tos.content)), tosUpdatedOnFmt: moment(tos.updated_on, 'x').format('MMMM YYYY')});
   } catch (error) {
     next(error);
   }
@@ -68,7 +69,7 @@ router.get('/invites', function(req, res) {
 router.get('/onboarding', async function(req, res, next) {
   try {
     const tos = await Tos.getCurrent();
-    res.render('onboarding', {...values, tosHtml: marked(tos.content)});
+    res.render('onboarding', {...values, tosHtml: xss(marked(tos.content))});
   } catch (error) {
     next(error);
   }
@@ -92,7 +93,14 @@ router.get('/login', async function(req, res, next) {
 // hardcoded in a doc, so they're always right for *this* deployment.
 router.get('/integrations', function(req, res, next) {
   const issuer = ((conf.oauth && conf.oauth.issuer) || `${req.protocol}://${req.get('host')}`).replace(/\/$/, '');
-  const ldapHost = issuer.replace(/^https?:\/\//, '').replace(/:\d+$/, '');
+  // The public-facing host (from the OAuth issuer). Used for OIDC links.
+  const issuerHost = issuer.replace(/^https?:\/\//, '').replace(/:\d+$/, '');
+
+  // The hostname advertised for direct LDAPS binds may be a separate,
+  // internal-only name so admins don't have to port-forward 636 publicly.
+  // Defaults to the issuer host to preserve prior behavior.
+  const ldapsHost = (conf.ldap && conf.ldap.ldapsHost) || issuerHost;
+  const ldapsPort = Number((conf.ldap && conf.ldap.ldapsPort) || 636) || 636;
 
   const userBase = (conf.ldap && conf.ldap.userBase) || 'ou=people,dc=example,dc=com';
   const groupBase = (conf.ldap && conf.ldap.groupBase) || 'ou=groups,dc=example,dc=com';
@@ -105,8 +113,9 @@ router.get('/integrations', function(req, res, next) {
     ...values,
     issuer,
     discoveryUrl: `${issuer}/.well-known/openid-configuration`,
-    ldapHost,
-    ldapsUrl: `ldaps://${ldapHost}:636`,
+    ldapHost: ldapsHost,
+    ldapsUrl: `ldaps://${ldapsHost}:${ldapsPort}`,
+    ldapsHostExplicit: !!(conf.ldap && conf.ldap.ldapsHost),
     baseDn,
     userBase,
     groupBase,
@@ -136,6 +145,45 @@ router.get('/token', function(req, res, next) {
   res.render('token', {...values});
 });
 
+router.get('/sites', async function(req, res, next) {
+  const net = require('net');
+  const url = require('url');
+  
+  const myId = process.env.LDAP_SERVER_ID || 'Standalone';
+  const hostsStr = process.env.LDAP_REPLICATION_HOSTS || '';
+  const hosts = hostsStr.split(' ').filter(h => h);
+  
+  const sites = await Promise.all(hosts.map(hostUrl => {
+      return new Promise((resolve) => {
+          try {
+              const u = new url.URL(hostUrl);
+              const port = u.port || (u.protocol === 'ldaps:' ? 636 : 389);
+              const hostname = u.hostname;
+              const socket = new net.Socket();
+              socket.setTimeout(2000);
+              
+              socket.on('connect', () => {
+                  socket.destroy();
+                  resolve({ url: hostUrl, status: 'Online' });
+              });
+              socket.on('timeout', () => {
+                  socket.destroy();
+                  resolve({ url: hostUrl, status: 'Offline (Timeout)' });
+              });
+              socket.on('error', (err) => {
+                  socket.destroy();
+                  resolve({ url: hostUrl, status: 'Offline (' + err.code + ')' });
+              });
+              socket.connect(port, hostname);
+          } catch (e) {
+              resolve({ url: hostUrl, status: 'Invalid URL' });
+          }
+      });
+  }));
+  
+  res.render('sites', { ...values, myId, sites });
+});
+
             
 router.get('/login/resetpassword/:token', async function(req, res, next){
 	let token = await PasswordResetToken.get(req.params.token);

nodejs/tests/integrations.test.js

@@ -0,0 +1,47 @@
+'use strict';
+
+const request = require('supertest');
+const app = require('../app');
+const conf = require('@simpleworkjs/conf');
+
+const ORIG_LDAP = { ...conf.ldap };
+const ORIG_OAUTH = { ...(conf.oauth || {}) };
+
+function restoreConf() {
+  conf.ldap = { ...conf.ldap, ...ORIG_LDAP };
+  conf.oauth = { ...(conf.oauth || {}), ...ORIG_OAUTH };
+}
+
+beforeEach(() => {
+  // Start each test from a known state; the local secrets.js may set an issuer.
+  conf.ldap = { ...conf.ldap, ldapsHost: '', ldapsPort: 636 };
+  if (conf.oauth) conf.oauth.issuer = '';
+});
+
+afterAll(() => {
+  restoreConf();
+});
+
+describe('GET /integrations', () => {
+  test('renders and derives LDAPS URL from the request host by default', async () => {
+    const res = await request(app)
+      .get('/integrations')
+      .set('Host', 'sso.example.com');
+
+    expect(res.status).toBe(200);
+    expect(res.text).toContain('ldaps://sso.example.com:636');
+  });
+
+  test('uses conf.ldap.ldapsHost when set', async () => {
+    conf.ldap = { ...conf.ldap, ldapsHost: 'ldap.internal.example.com', ldapsPort: 1636 };
+
+    const res = await request(app)
+      .get('/integrations')
+      .set('Host', 'public.example.com');
+
+    expect(res.status).toBe(200);
+    expect(res.text).toContain('ldaps://ldap.internal.example.com:1636');
+    expect(res.text).not.toContain('ldaps://public.example.com:636');
+    expect(res.text).toContain('Custom <code>conf.ldap.ldapsHost</code>');
+  });
+});

nodejs/views/integrations.ejs

@@ -409,6 +409,46 @@
 	</p>
 
 	<div class="row g-3">
+		<div class="col-12">
+			<div class="card shadow-sm border-warning">
+				<div class="card-header bg-warning bg-opacity-10">
+					<i class="fa-solid fa-triangle-exclamation"></i>
+					LDAPS hostname: keep LDAP binds off the public internet
+				</div>
+				<div class="card-body">
+					<p class="small mb-2">
+						LDAPS requires a <strong>hostname</strong>, not a bare IP address, because
+						the TLS client verifies the server name against the certificate.
+						The URL below <% if (ldapsHostExplicit) { %>is set to <code><%= ldapHost %></code> from
+						<code>conf.ldap.ldapsHost</code>.<% } else { %>currently matches the public
+						OAuth issuer host — convenient, but that implies clients reach it through
+						your router on port 636. <strong>Do not port-forward 636 to the internet</strong>
+						for LDAP simple binds; instead pick an internal-only hostname and set
+						<code>conf.ldap.ldapsHost</code>.<% } %>
+					</p>
+					<ul class="small mb-2">
+						<li><strong>Same Docker/network host (recommended for the proxy or apps on this machine):</strong>
+							use <code>ldaps://sso-manager:636</code> (the internal service name).
+							Set <code>conf.ldap.ldapsHost = 'sso-manager'</code>.</li>
+						<li><strong>LAN host:</strong> create an internal DNS record like
+							<code>ldap.internal.example.com</code> → the local IP, get or generate a cert
+							whose SAN matches that name, and set <code>conf.ldap.ldapsHost</code>.
+							A wildcard for <code>*.internal.example.com</code> works well.</li>
+						<li><strong>Public hostname:</strong> only acceptable behind a VPN or firewall
+							lockdown — never exposed to the open internet.</li>
+					</ul>
+					<p class="small mb-0">
+						<b>Trusting the cert:</b> The bundled slapd uses a self-signed cert unless you
+						mount your own at <code>/etc/openldap/certs</code>. Clients must either trust
+						that cert, or set <code>TLS_REQCERT never</code> / <code>rejectUnauthorized: false</code>
+						for LAN-only use. See <a href="/docs/ldap">LDAP docs</a> for the full
+						runbook, including how to set <code>ldapsHost</code> in
+						<code>conf/secrets.js</code> or via <code>app_ldap__ldapsHost=...</code>.
+					</p>
+				</div>
+			</div>
+		</div>
+
 		<div class="col-lg-6">
 			<div class="card shadow-lg">
 				<div class="card-header shadow">
@@ -428,6 +468,11 @@
 								<input type="text" id="f-ldapsUrl" class="form-control font-monospace" readonly value="<%= ldapsUrl %>">
 								<button class="btn btn-outline-secondary" type="button" onclick="copyField('f-ldapsUrl', this)" title="Copy"><i class="fa-solid fa-copy"></i></button>
 							</div>
+							<% if (ldapsHostExplicit) { %>
+							<small class="field-help text-muted d-block">
+								Custom <code>conf.ldap.ldapsHost</code> — override in your secrets file if this name doesn't resolve from the client.
+							</small>
+							<% } %>
 						</dd>
 
 						<dt class="col-sm-4">Base DN</dt>
@@ -522,6 +567,8 @@
 			'git clone https://github.com/theta42/ldap-client.git',
 			'cd ldap-client',
 			'cat > ldap.vars << \'EOF\'',
+			'# LDAPS host advertised on the Integrations page. If this is an internal-only',
+			'# hostname, make sure it resolves from this host and the cert SAN matches it.',
 			'export ldap_host="<%= ldapHost %>"',
 			'export ldap_base_dn="<%= baseDn %>"',
 			'',

nodejs/views/profile.ejs

@@ -240,6 +240,7 @@
 					<i>Phone:</i> <b>{{mobile}}</b>
 					{{#phoneVerified}}<span class="badge bg-success ms-1"><i class="fa-solid fa-circle-check"></i> Verified</span>{{/phoneVerified}}
 					<br />
+					<i>Location (Site):</i> <b>{{location}} </b><br />
 					<i>LDAP DN:</i> <b>{{dn}} </b><br />
 					<i>Home Directory:</i> <b>{{homeDirectory}} </b><br />
 					<i>Login Shell:</i> <b>{{loginShell}} </b><br />
@@ -323,6 +324,10 @@
 							<label class="form-label">Mobile Phone</label>
 							<input type="text" class="form-control" name="mobile" placeholder="9175551234" value="{{mobile}}" />
 						</div>
+						<div class="mb-3">
+							<label class="form-label">Location (Site)</label>
+							<input type="text" class="form-control" name="location" placeholder="Site One" value="{{location}}" />
+						</div>
 						<div class="mb-3">
 							<label class="form-label">Home Directory</label>
 							<input type="text" class="form-control" name="homeDirectory" placeholder="/home/jsmith" value="{{homeDirectory}}" />

nodejs/views/sites.ejs

@@ -0,0 +1,51 @@
+<%- include('header') %>
+
+<div class="container-fluid" style="margin-top: 80px;">
+  <div class="row">
+    <div class="col-md-8 offset-md-2">
+      <div class="card shadow-lg mb-4">
+        <div class="card-header">
+          <i class="fa-solid fa-network-wired"></i> Sites & Replication
+        </div>
+        <div class="card-body">
+          <p class="mb-4">
+            This page shows the status of Multi-Master LDAP replication peers.
+            <br/>Your Server ID: <strong><%= myId %></strong>
+          </p>
+          
+          <table class="table table-striped table-bordered">
+            <thead class="table-dark">
+              <tr>
+                <th>Site LDAP URL</th>
+                <th>Replication Status</th>
+              </tr>
+            </thead>
+            <tbody>
+              <% if (sites.length === 0) { %>
+                <tr>
+                  <td colspan="2" class="text-center text-muted">No replication peers configured in environment (LDAP_REPLICATION_HOSTS is empty).</td>
+                </tr>
+              <% } else { %>
+                <% sites.forEach(function(site) { %>
+                  <tr>
+                    <td class="align-middle"><strong><%= site.url %></strong></td>
+                    <td class="align-middle">
+                      <% if (site.status === 'Online') { %>
+                        <span class="badge bg-success"><i class="fa-solid fa-circle-check"></i> Online</span>
+                      <% } else { %>
+                        <span class="badge bg-danger"><i class="fa-solid fa-circle-xmark"></i> <%= site.status %></span>
+                      <% } %>
+                    </td>
+                  </tr>
+                <% }); %>
+              <% } %>
+            </tbody>
+          </table>
+          
+        </div>
+      </div>
+    </div>
+  </div>
+</div>
+
+<%- include('footer') %>

nodejs/views/top.ejs

@@ -56,6 +56,12 @@
   	          Invites
   	        </a>
   	      </li>
+  	      <li class="nav-item group-required group-required-app_sso_admin">
+  	        <a class="nav-link" href="/sites">
+  	          <i class="fa-solid fa-network-wired"></i>
+  	          Sites
+  	        </a>
+  	      </li>
   	      <li class="nav-item group-required group-required-app_sso_admin">
   	        <a class="nav-link" href="/dashboard">
   	          <i class="fa-solid fa-gauge-high"></i>

nodejs/views/user_form.ejs

@@ -141,6 +141,11 @@ async function fetchUsernameSuggestions() {
 		<input type="text" class="form-control shadow" name="mobile" placeholder="+14155551234" />
 	</div>
 
+	<div class="mb-3">
+		<label class="form-label">Location (Site) <small class="text-muted">(optional)</small></label>
+		<input type="text" class="form-control shadow" name="location" placeholder="Site One" />
+	</div>
+
 	<div class="mb-3">
 		<label class="form-label">Password</label>
 		<input type="password" class="form-control shadow" name="userPassword" placeholder="Atleast 5 char. long" validate="password:5"/>

secrets.js.example

@@ -30,6 +30,10 @@ module.exports = {
         bindPassword: 'your-ldap-password',
         userBase: 'ou=people,dc=example,dc=com',
         groupBase: 'ou=groups,dc=example,dc=com',
+        // ldapsHost: 'ldap.internal.example.com', // optional: hostname shown for
+        // direct LDAPS binds on /integrations. Leave empty to derive from the
+        // OAuth issuer. Set an internal-only name to avoid port-forwarding 636.
+        // ldapsPort: 636,
     },
     smtp: {
         host: 'smtp.example.com',