Security Features

LDAP Manager implements enterprise-grade security features to protect your directory credentials and prevent common attacks.

✅ Zero Critical Vulnerabilities: All security features have been audited and tested.

1. Encrypted Password Storage

Overview

LDAP bind passwords are never stored in plaintext. All passwords are encrypted at rest using Fernet symmetric encryption with automatic TTL expiration.

Technical Details

How It Works

  1. User enters password in browser
  2. Password sent via HTTPS to backend
  3. Backend verifies password with LDAP server
  4. On success, password encrypted with Fernet and stored
  5. Encrypted cache includes timestamp and TTL
  6. On subsequent requests, password decrypted from cache
  7. Expired passwords automatically deleted

Storage Format

{
  "cluster": "production-ldap",
  "bind_dn": "cn=Manager,dc=example,dc=com",
  "encrypted_password": "gAAAAABl...encrypted_blob...",
  "timestamp": 1705843200.123,
  "ttl": 3600
}

Security Properties

2. LDAP Injection Protection

Overview

All user input used in LDAP search filters is sanitized and escaped to prevent LDAP filter injection attacks.

Attack Vector Example

Without Protection:

User input: *)(objectClass=*
Search filter: (|(uid=*)(objectClass=*)(cn=...))
Result: Bypass intended filter, return ALL entries

With Protection:

User input: *)(objectClass=*
After escaping: \2a\29\28objectClass=\2a
Search filter: (|(uid=\2a\29\28objectClass=\2a)(cn=...))
Result: Harmless literal search for that exact string

Implementation

Uses Python's ldap.filter.escape_filter_chars() which escapes all special LDAP filter characters:

Protected Endpoints

3. CORS Security

Overview

Cross-Origin Resource Sharing (CORS) is configured with strict origin whitelisting to prevent unauthorized cross-site requests.

Configuration

Set allowed origins via environment variable:

ALLOWED_ORIGINS=https://ldap.company.com,https://ldap-backup.company.com

Default Behavior

Security Properties

4. Container Security

Non-Root User

Container runs as dedicated non-root user:

# User: ldapmanager
# UID: 1000
# Home: /app

Why This Matters:

File System Permissions

/app/.cache/      → 0700 (rwx------)  # Cache directory
/app/.cache/*.json → 0600 (rw-------)  # Encrypted password files
/app/.secrets/     → 0700 (rwx------)  # Secrets directory
/app/.secrets/encryption.key → 0600   # Encryption key

Security Options

security_opt:
  - no-new-privileges:true  # Prevents privilege escalation

5. Input Validation

Configuration Validation

All configuration is validated at startup using Pydantic schemas:

API Input Validation

FastAPI with Pydantic validates all API inputs:

6. Timeout Protection

LDAP Operation Timeouts

# Network timeout: 30 seconds
# Operation timeout: 30 seconds

Purpose:

7. Audit Logging

Operations Logged

Log Format

{
  "timestamp": "2024-01-25T10:30:45.123Z",
  "level": "WARNING",
  "logger": "app.api.entries",
  "message": "LDAP entry deleted",
  "cluster": "production",
  "dn": "cn=olduser,dc=example,dc=com",
  "operation": "DELETE",
  "operator": "admin"
}

Security Properties

Security Testing

Automated Security Tests

Comprehensive test suite includes security-specific tests:

Test Coverage

# Run security tests
cd backend
pytest tests/test_password_cache.py -v
pytest tests/test_api_entries.py::TestSearchEndpoint::test_search_ldap_injection_protected -v

Security Best Practices

Production Deployment

  1. HTTPS Only: Always use HTTPS in production (reverse proxy required)
  2. CORS Configuration: Set ALLOWED_ORIGINS to your production domain
  3. Strong Passwords: Use complex LDAP bind passwords
  4. Regular Updates: Keep Docker images up to date
  5. Network Isolation: Run in private network when possible
  6. Firewall Rules: Restrict access to LDAP ports (389/636)

Monitoring

  1. Monitor health check endpoint: /health
  2. Set up alerts for authentication failures
  3. Review audit logs regularly
  4. Monitor for unusual access patterns

Backup & Recovery

  1. Backup config.yml regularly
  2. Backup /app/.secrets/ volume (encryption key)
  3. Document disaster recovery procedures
  4. Test backup restoration periodically

Vulnerability Reporting

If you discover a security vulnerability, please report it responsibly:

Compliance & Standards

Resources