ldpa commit 2

src/app.rs

@@ -180,6 +180,7 @@ async fn home(State(state): State<SharedState>) -> Response {
         include_str!("../static/home.html"),
         &state.asset_version,
         state.registration_enabled,
+        state.ldap.is_some(),
         &state.frontend_log_level,
         state.upload_max_size_bytes,
         "home",
@@ -195,6 +196,7 @@ async fn pad(State(state): State<SharedState>, Path(slug): Path<String>) -> Resp
                 &html,
                 &state.asset_version,
                 state.registration_enabled,
+                state.ldap.is_some(),
                 &state.frontend_log_level,
                 state.upload_max_size_bytes,
                 "pad",
@@ -222,6 +224,7 @@ async fn public_page(State(state): State<SharedState>, Path(token): Path<String>
             include_str!("../static/public.html"),
             &state.asset_version,
             state.registration_enabled,
+            state.ldap.is_some(),
             &state.frontend_log_level,
             state.upload_max_size_bytes,
             "public",
@@ -254,6 +257,7 @@ async fn workspace(
                 &html,
                 &state.asset_version,
                 state.registration_enabled,
+                state.ldap.is_some(),
                 &state.frontend_log_level,
                 state.upload_max_size_bytes,
                 "workspace",
@@ -308,6 +312,7 @@ async fn note(
                 &html,
                 &state.asset_version,
                 state.registration_enabled,
+                state.ldap.is_some(),
                 &state.frontend_log_level,
                 state.upload_max_size_bytes,
                 "note",

src/assets.rs

@@ -27,12 +27,13 @@ pub fn render_html(
     template: &str,
     asset_version: &str,
     registration_enabled: bool,
+    external_auth: bool,
     frontend_log_level: &str,
     upload_max_size_bytes: usize,
     entrypoint: &str,
 ) -> Response {
     let urls = AssetUrls::new(asset_version);
-    let frontend_config = frontend_config(frontend_log_level, upload_max_size_bytes);
+    let frontend_config = frontend_config(frontend_log_level, upload_max_size_bytes, external_auth);
     let html = template
         .replace("__APP_STYLESHEET__", &urls.stylesheet("styles"))
         .replace("__APP_IMPORT_MAP__", &urls.import_map())
@@ -59,11 +60,12 @@ pub fn stylesheet_tag(asset_version: &str, name: &str) -> String {
     AssetUrls::new(asset_version).stylesheet(name)
 }
 
-fn frontend_config(frontend_log_level: &str, upload_max_size_bytes: usize) -> String {
+fn frontend_config(frontend_log_level: &str, upload_max_size_bytes: usize, external_auth: bool) -> String {
     format!(
-        r#"<script>window.__RUSTPAD_CONFIG__=Object.freeze({{frontendLogLevel:"{}",uploadMaxSizeBytes:{}}});</script>"#,
+        r#"<script>window.__RUSTPAD_CONFIG__=Object.freeze({{frontendLogLevel:"{}",uploadMaxSizeBytes:{},externalAuth:{}}});</script>"#,
         escape_js_string(frontend_log_level),
         upload_max_size_bytes,
+        external_auth,
     )
 }
 

src/ldap_auth.rs

@@ -53,13 +53,26 @@ pub async fn authenticate(
         config.email_attribute.as_str(),
         config.display_name_attribute.as_str(),
     ];
-    let (entries, _) = ldap
-        .search(&config.base_dn, Scope::Subtree, &filter, attributes)
+    let (mut entries, _) = ldap
+        .search(&config.base_dn, Scope::Subtree, &filter, attributes.clone())
         .await
         .map_err(|error| format!("LDAP search failed: {error}"))?
         .success()
         .map_err(|error| format!("LDAP search rejected: {error}"))?;
 
+    // Allow users to sign in with their directory e-mail even when the configured
+    // primary filter searches by uid/sAMAccountName only.
+    if entries.is_empty() && login.trim().contains('@') {
+        let email_filter = format!("({}={})", config.email_attribute, escaped);
+        let (email_entries, _) = ldap
+            .search(&config.base_dn, Scope::Subtree, &email_filter, attributes)
+            .await
+            .map_err(|error| format!("LDAP e-mail search failed: {error}"))?
+            .success()
+            .map_err(|error| format!("LDAP e-mail search rejected: {error}"))?;
+        entries = email_entries;
+    }
+
     if entries.len() != 1 {
         let _ = ldap.unbind().await;
         return Ok(None);