finall ldap support

.env.example

@@ -85,6 +85,15 @@ AUTHORIZATION_TYPE=local
 # Shared LDAP / Active Directory connection settings
 # LDAP_URL=ldap://10.0.0.22:389
 # LDAP_STARTTLS=false
+
+# Verify the LDAP server certificate for LDAPS/StartTLS.
+# Set false only for trusted internal/test servers with a self-signed certificate.
+# This allows encrypted TLS without mounting a custom CA certificate.
+LDAP_TLS_VERIFY=true
+
+# Connection and LDAP operation timeouts.
+LDAP_CONNECT_TIMEOUT_SECONDS=5
+LDAP_OPERATION_TIMEOUT_SECONDS=10
 # For LDAPS: LDAP_URL=ldaps://ldap.example.org:636 and LDAP_STARTTLS=false
 # For StartTLS: LDAP_URL=ldap://ldap.example.org:389 and LDAP_STARTTLS=true
 # LDAP_BIND_DN=cn=admin,dc=example,dc=org
@@ -94,12 +103,23 @@ AUTHORIZATION_TYPE=local
 # LDAP_EMAIL_ATTRIBUTE=mail
 # LDAP_DISPLAY_NAME_ATTRIBUTE=displayName
 
+# Stable directory identifier. Defaults:
+# ldap: entryUUID
+# ad: objectGUID
+# LDAP_EXTERNAL_ID_ATTRIBUTE=entryUUID
+
+# Reject directory users without a valid mail attribute.
+LDAP_EMAIL_REQUIRED=true
+
+# Link an existing account with the same e-mail on first directory login.
+# Keep false unless you intentionally migrate existing local/legacy LDAP accounts.
+LDAP_LINK_EXISTING_BY_EMAIL=false
+
 # Optional overrides. Defaults depend on AUTHORIZATION_TYPE:
 # ldap: LDAP_USER_FILTER=(uid={username}), LDAP_USERNAME_ATTRIBUTE=uid
 # ad:   LDAP_USER_FILTER=(|(sAMAccountName={username})(userPrincipalName={username}))
 #       LDAP_USERNAME_ATTRIBUTE=sAMAccountName
 # LDAP_USER_FILTER=(uid={username})
 # LDAP_USERNAME_ATTRIBUTE=uid
-# email auth: LDAP_EMAIL_ATTRIBUTE=mail
-#for both
-#LDAP_USER_FILTER=(|(uid={username})(mail={username}))
+# To allow login by either username or e-mail:
+# LDAP_USER_FILTER=(|(uid={username})(mail={username}))