ldap-authentication 3.3.4 → 4.0.3

package/.devcontainer/docker-compose.yml

@@ -8,7 +8,7 @@ services:
     command: sleep infinity
 
   ldap:
-    image: bitnami/openldap
+    image: symas/openldap:2.6
     ports:
       - '1389:1389'
       - '1636:1636'

package/.github/workflows/integration-test.yml

@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        node-version: [16.x, 17.x, 18.x, 20.x, 22.x]
+        node-version: [20.x, 22.x, 24.x]
 
     name: 'Integration Node v${{ matrix.node-version }}'
 
@@ -46,7 +46,7 @@ jobs:
         uses: actions/setup-node@v3
         with:
           node-version: ${{ matrix.node-version }}
-      - run: npm install
+      - run: npm ci
       - run: npm run test
 
       - name: Stop containers

package/.github/workflows/npm-publish.yml

@@ -1,33 +1,22 @@
-# This workflow will run tests using node and then publish a package to GitHub Packages when a release is created
-# For more information see: https://docs.github.com/en/actions/publishing-packages/publishing-nodejs-packages
-
-name: Publish to NPM
+name: Publish Package
 
 on:
   release:
     types: [created]
 
+permissions:
+  id-token: write # Required for OIDC
+  contents: read
+
 jobs:
-  build:
+  publish:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-      - run: npm ci
 
-
-  publish-npm:
-    needs: build
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
-          node-version: 20
-          registry-url: https://registry.npmjs.org/
+          node-version: '24'
+          registry-url: 'https://registry.npmjs.org'
       - run: npm ci
       - run: npm publish
-        env:
-          NODE_AUTH_TOKEN: ${{secrets.npm_token}}

package/README.md

@@ -147,6 +147,43 @@ async function auth() {
 auth()
 ```
 
+### Example with StartTLS
+
+```javascript
+import { authenticate } from 'ldap-authentication'
+
+async function auth() {
+  // auth with admin
+  let options = {
+    ldapOpts: {
+      url: 'ldap://ldap.example.com',
+      tlsOptions: {
+        rejectUnauthorized: false, // For self-signed certificates
+        minVersion: 'TLSv1.2',
+        servername: 'ldap.example.com' // For SNI (Server Name Indication)
+      }
+    },
+    starttls: true, // Enable StartTLS
+    adminDn: 'cn=admin,dc=example,dc=com',
+    adminPassword: 'password',
+    userPassword: 'password',
+    userSearchBase: 'dc=example,dc=com',
+    usernameAttribute: 'uid',
+    username: 'testuser'
+  }
+
+  let user = await authenticate(options)
+  console.log(user)
+}
+
+auth()
+```
+
+**Important Notes for StartTLS:**
+- Use `ldap://` URLs with `starttls: true` (not `ldaps://`)
+- For `ldaps://` URLs, omit `starttls` and the connection will use TLS from the start
+- TLS options like `rejectUnauthorized`, `minVersion`, and `servername` can be specified in `ldapOpts.tlsOptions`
+
 ## Parameters
 
 - `ldapOpts`: This is passed to `ldapts` client directly
@@ -172,7 +209,9 @@ auth()
   to find the user and get user details in LDAP. Example: `some user input`
 - `attributes`: A list of attributes of a user details to be returned from the LDAP server.
   If is set to `[]` or ommited, all details will be returned. Example: `['sn', 'cn']`
-- `starttls`: Boolean. Use `STARTTLS` or not
+- `starttls`: Boolean. Use `STARTTLS` or not. When `true`, the connection will be upgraded to TLS
+  using the STARTTLS extended operation. TLS options can be specified in `ldapOpts.tlsOptions`.
+  Note: Use `starttls: true` with `ldap://` URLs, not `ldaps://` URLs
 - `groupsSearchBase`: if specified with groupClass, will serve as search base for authenticated user groups
 - `groupClass`: if specified with groupsSearchBase, will be used as objectClass in search filter for authenticated user groups
 - `groupMemberAttribute`: if specified with groupClass and groupsSearchBase, will be used as member name (if not specified this defaults to `member`) in search filter for authenticated user groups
@@ -182,6 +221,28 @@ auth()
 
 The user object if `authenticate()` is success.
 
+In version 4, a new function is added: `authenticateResult()`. It has the same call signature as `authenticate()` but returns an object `AuthenticationResult` with more details.
+
+
+### AuthenticationResult Object
+
+AuthenticationResult object has the following fields:
+
+- `code`: number. constants:
+  - `AUTH_RESULT_FAILURE` = 0
+  - `AUTH_RESULT_SUCCESS` = 1
+  - `AUTH_RESULT_FAILURE_IDENTITY_NOT_FOUND` = -1
+  - `AUTH_RESULT_FAILURE_IDENTITY_AMBIGUOUS` = -2
+  - `AUTH_RESULT_FAILURE_CREDENTIAL_INVALID` = -3
+  - `AUTH_RESULT_FAILURE_UNCATEGORIZED` = -4
+- `identity`: identity supplied as string
+- `user`: user object if authentication is successful, otherwise null
+- `message`: authentication message array, which contains server messages
+- `client`: ldapClient instance
+
+
+## Old Stuff
+
 In version 2, The user object has a `raw` field that has the raw data from the LDAP/AD server. It can be used to access buffer objects (profile pics for example).
 
 Buffer data can now be accessed by `user.raw.profilePhoto`, etc, instead of `user.profilePhoto`.
@@ -221,4 +282,6 @@ export async function verifyLogin(email: string, password: string) {
 
 Version 2 supports Node version 12, 14, 15, 16, 17 and 18.
 
-Version 3 supports Node version 16, 17, 18, 20 and 22,
+Version 3 supports Node version 16, 17, 18, 20 and 22.
+
+Version 4 supports Node version 20 and above.

package/docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   ldap:
-    image: bitnami/openldap:2.6.3
+    image: symas/openldap:2.6
     ports:
       - '1389:1389'
       - '1636:1636'

package/index.d.ts

@@ -17,6 +17,7 @@ declare module 'ldap-authentication' {
     groupMemberUserAttribute?: string
     userPassword?: string
     attributes?: string[]
+    explicitBufferAttributes?: string[]
   }
 
   export function authenticate(options: AuthenticationOptions): Promise<any>

package/index.js

@@ -38,12 +38,82 @@ function _ldapEscapeDN(s) {
   return ret
 }
 
+const AUTH_RESULT_FAILURE = 0
+const AUTH_RESULT_SUCCESS = 1
+const AUTH_RESULT_FAILURE_IDENTITY_NOT_FOUND = -1
+const AUTH_RESULT_FAILURE_IDENTITY_AMBIGUOUS = -2
+const AUTH_RESULT_FAILURE_CREDENTIAL_INVALID = -3
+const AUTH_RESULT_FAILURE_UNCATEGORIZED = -4
+
+class AuthenticationResult {
+  #authCode = AUTH_RESULT_FAILURE_UNCATEGORIZED
+  #identity
+  #user
+  #messages = []
+  #client
+
+  constructor(authCode, identity, user, messages, client) {
+    this.#authCode = authCode // one of the above constants
+    this.#identity = identity // identity supplied as string
+    this.#user     = user // user object found on ldap server OR null
+    this.#messages = messages // authentication messages array, which contains server messages
+    this.#client   = client // ldapClient instance
+  }
+
+  get code() {
+    return this.#authCode
+  }
+
+  get identity() {
+    return this.#identity
+  }
+
+  get messages() {
+    return this.#messages
+  }
+
+  get client() {
+    return this.#client
+  }
+
+  get user() {
+    return this.#user
+  }
+}
+
+const authenticationMessages = {
+  AUTH_RESULT_FAILURE: 'Authentication failed',
+  AUTH_RESULT_SUCCESS: 'Authentication successful',
+  AUTH_RESULT_FAILURE_IDENTITY_NOT_FOUND: 'Authentication identity not found',
+  AUTH_RESULT_FAILURE_IDENTITY_AMBIGUOUS: 'Authentication identity ambiguous',
+  AUTH_RESULT_FAILURE_CREDENTIAL_INVALID: 'Invalid credentials',
+  AUTH_RESULT_FAILURE_UNCATEGORIZED: 'Uncategorized authentication failure',
+}
+
 // bind and return the ldap client
 async function _ldapBind(dn, password, starttls, ldapOpts) {
   // TODO: check if ldapts expects escaped dn or not (possible double escaping problems?)
   dn = _ldapEscapeDN(dn)
   ldapOpts.connectTimeout = ldapOpts.connectTimeout || 5000
-  let client = new ldapts.Client(ldapOpts)
+
+  // When using StartTLS, we need to exclude tlsOptions from the Client constructor
+  // and only pass them to the startTLS() method to avoid connection conflicts.
+  // According to ldapts documentation:
+  // - For LDAPS (ldaps://): pass tlsOptions to Client constructor
+  // - For StartTLS (ldap://): do NOT pass tlsOptions to Client constructor, only to startTLS()
+  // - For plain LDAP (ldap://): do NOT pass tlsOptions to Client constructor
+  let clientOpts = ldapOpts
+  const isLdaps = ldapOpts.url && ldapOpts.url.startsWith('ldaps://')
+
+  // Only pass tlsOptions to Client constructor if using ldaps:// protocol
+  // For ldap:// protocol (plain or StartTLS), exclude tlsOptions from constructor
+  if (!isLdaps && ldapOpts.tlsOptions) {
+    // Create a shallow copy of ldapOpts without tlsOptions for the Client constructor
+    const { tlsOptions, ...optsWithoutTls } = ldapOpts
+    clientOpts = optsWithoutTls
+  }
+
+  let client = new ldapts.Client(clientOpts)
 
   if (starttls) {
     await client.startTLS(ldapOpts.tlsOptions)
@@ -60,7 +130,8 @@ async function _searchUser(
   searchBase,
   usernameAttribute,
   username,
-  attributes = null
+  attributes = null,
+  explicitBufferAttributes = null
 ) {
   let filter = new ldapts.EqualityFilter({
     attribute: usernameAttribute,
@@ -74,6 +145,9 @@ async function _searchUser(
   if (attributes) {
     searchOptions.attributes = attributes
   }
+  if(explicitBufferAttributes) {
+    searchOptions.explicitBufferAttributes = explicitBufferAttributes
+  }
 
   // TODO: we don't support reference yet
   // If the server was able to locate the entry referred to by the baseObject
@@ -93,8 +167,24 @@ async function _searchUser(
     !searchEntries[0] ||
     !searchEntries[0].dn
   ) {
-    user = null
+    return new AuthenticationResult(
+      AUTH_RESULT_FAILURE_IDENTITY_NOT_FOUND,
+      username,
+      null,
+      [authenticationMessages.AUTH_RESULT_FAILURE_IDENTITY_NOT_FOUND],
+      ldapClient
+    )
   } else {
+    if (searchEntries.length > 1) {
+      return new AuthenticationResult(
+        AUTH_RESULT_FAILURE_IDENTITY_AMBIGUOUS,
+        username,
+        null,
+        [authenticationMessages.AUTH_RESULT_FAILURE_IDENTITY_AMBIGUOUS],
+        ldapClient
+      )
+    }
+
     user = searchEntries[0]
   }
 
@@ -106,7 +196,22 @@ async function _searchUser(
       }
     }
   }
-  return user
+  // when attribute is one of the explicitBufferAttributes, should convert to base64 string
+  if (user != null && explicitBufferAttributes != null) {
+    for (let attr of explicitBufferAttributes) {
+      if (Buffer.isBuffer(user[attr])) {
+        user[attr] = user[attr].toString('base64')
+      }
+    }
+  }
+
+  return new AuthenticationResult(
+    AUTH_RESULT_SUCCESS,
+    username,
+    user,
+    [authenticationMessages.AUTH_RESULT_SUCCESS],
+    ldapClient
+  )
 }
 
 // search a groups which user is member
@@ -170,7 +275,8 @@ async function authenticateWithAdmin(
   groupClass,
   groupMemberAttribute = 'member',
   groupMemberUserAttribute = 'dn',
-  attributes = null
+  attributes = null,
+  explicitBufferAttributes = null
 ) {
   let ldapAdminClient
   try {
@@ -184,23 +290,39 @@ async function authenticateWithAdmin(
     if (ldapAdminClient && ldapAdminClient.isConnected) {
       await ldapAdminClient.unbind()
     }
-    throw new LdapAuthenticationError(error)
+
+    return new AuthenticationResult(
+      AUTH_RESULT_FAILURE,
+      username,
+      null,
+      [authenticationMessages.AUTH_RESULT_FAILURE, error.message || 'admin bind failed'],
+      ldapAdminClient
+    )
   }
-  let user = await _searchUser(
+
+  let searchResult = await _searchUser(
     ldapAdminClient,
     userSearchBase,
     usernameAttribute,
     username,
-    attributes
+    attributes,
+    explicitBufferAttributes
   )
+
+  let user = searchResult.user
+
   if (!user || !user.dn) {
     ldapOpts.log &&
       ldapOpts.log.trace(
         `admin did not find user! (${usernameAttribute}=${username})`
       )
     await ldapAdminClient.unbind()
-    throw new LdapAuthenticationError(
-      'user not found or usernameAttribute is wrong'
+    return new AuthenticationResult(
+      AUTH_RESULT_FAILURE_IDENTITY_NOT_FOUND,
+      username,
+      null,
+      [authenticationMessages.AUTH_RESULT_FAILURE_IDENTITY_NOT_FOUND],
+      ldapAdminClient
     )
   }
   let userDn = user.dn
@@ -211,7 +333,14 @@ async function authenticateWithAdmin(
     if (ldapUserClient && ldapUserClient.isConnected) {
       await ldapUserClient.unbind()
     }
-    throw new LdapAuthenticationError(error)
+
+    return new AuthenticationResult(
+      AUTH_RESULT_FAILURE_CREDENTIAL_INVALID,
+      username,
+      null,
+      [authenticationMessages.AUTH_RESULT_FAILURE_CREDENTIAL_INVALID, error.message || 'invalid credentials'],
+      ldapAdminClient
+    )
   }
   if (groupsSearchBase && groupClass && groupMemberAttribute) {
     let groups = await _searchUserGroups(
@@ -226,7 +355,14 @@ async function authenticateWithAdmin(
   }
   await ldapAdminClient.unbind()
   await ldapUserClient.unbind()
-  return user
+
+  return new AuthenticationResult(
+    AUTH_RESULT_SUCCESS,
+    username,
+    user,
+    [authenticationMessages.AUTH_RESULT_SUCCESS],
+    ldapAdminClient
+  )
 }
 
 async function authenticateWithUser(
@@ -241,7 +377,8 @@ async function authenticateWithUser(
   groupClass,
   groupMemberAttribute = 'member',
   groupMemberUserAttribute = 'dn',
-  attributes = null
+  attributes = null,
+  explicitBufferAttributes = null
 ) {
   let ldapUserClient
   try {
@@ -250,28 +387,54 @@ async function authenticateWithUser(
     if (ldapUserClient && ldapUserClient.isConnected) {
       await ldapUserClient.unbind()
     }
-    throw new LdapAuthenticationError(error)
+
+    return new AuthenticationResult(
+      AUTH_RESULT_FAILURE,
+      username,
+      null,
+      [authenticationMessages.AUTH_RESULT_FAILURE, error.message || 'user bind failed'],
+      ldapUserClient
+    )
   }
   if (!usernameAttribute || !userSearchBase) {
     // if usernameAttribute is not provided, no user detail is needed.
     await ldapUserClient.unbind()
-    return true
+    return new AuthenticationResult(
+      AUTH_RESULT_SUCCESS,
+      username,
+      {},
+      [authenticationMessages.AUTH_RESULT_SUCCESS],
+      ldapUserClient
+    )
   }
-  let user = await _searchUser(
+
+  let searchResult = await _searchUser(
     ldapUserClient,
     userSearchBase,
     usernameAttribute,
     username,
-    attributes
+    attributes,
+    explicitBufferAttributes
   )
+
+  let user = searchResult.user
+
   if (!user || !user.dn) {
     ldapOpts.log &&
       ldapOpts.log.trace(
         `user logged in, but user details could not be found. (${usernameAttribute}=${username}). Probabaly wrong attribute or searchBase?`
       )
     await ldapUserClient.unbind()
-    throw new LdapAuthenticationError(
-      'user logged in, but user details could not be found. Probabaly usernameAttribute or userSearchBase is wrong?'
+
+    return new AuthenticationResult(
+      AUTH_RESULT_FAILURE,
+      username,
+      null,
+      [
+        authenticationMessages.AUTH_RESULT_FAILURE,
+        'user logged in, but user details could not be found. Probabaly usernameAttribute or userSearchBase is wrong?',
+      ],
+      ldapUserClient
     )
   }
   if (groupsSearchBase && groupClass && groupMemberAttribute) {
@@ -286,7 +449,14 @@ async function authenticateWithUser(
     user.groups = groups
   }
   await ldapUserClient.unbind()
-  return user
+
+  return new AuthenticationResult(
+    AUTH_RESULT_SUCCESS,
+    username,
+    user,
+    [authenticationMessages.AUTH_RESULT_SUCCESS],
+    ldapUserClient
+  )
 }
 
 async function verifyUserExists(
@@ -301,7 +471,8 @@ async function verifyUserExists(
   groupClass,
   groupMemberAttribute = 'member',
   groupMemberUserAttribute = 'dn',
-  attributes = null
+  attributes = null,
+  explicitBufferAttributes = null
 ) {
   let ldapAdminClient
   try {
@@ -315,23 +486,41 @@ async function verifyUserExists(
     if (ldapAdminClient && ldapAdminClient.isConnected) {
       await ldapAdminClient.unbind()
     }
-    throw new LdapAuthenticationError(error)
+    return new AuthenticationResult(
+      AUTH_RESULT_FAILURE,
+      username,
+      null,
+      [authenticationMessages.AUTH_RESULT_FAILURE, error.message || 'admin bind failed'],
+      ldapAdminClient
+    )
   }
-  let user = await _searchUser(
+
+  let searchResult = await _searchUser(
     ldapAdminClient,
     userSearchBase,
     usernameAttribute,
     username,
-    attributes
+    attributes,
+    explicitBufferAttributes
   )
+
+  let user = searchResult.user
+
   if (!user || !user.dn) {
     ldapOpts.log &&
       ldapOpts.log.trace(
         `admin did not find user! (${usernameAttribute}=${username})`
       )
     await ldapAdminClient.unbind()
-    throw new LdapAuthenticationError(
-      'user not found or usernameAttribute is wrong'
+    return new AuthenticationResult(
+      AUTH_RESULT_FAILURE_IDENTITY_NOT_FOUND,
+      username,
+      null,
+      [
+        authenticationMessages.AUTH_RESULT_FAILURE_IDENTITY_NOT_FOUND,
+        'user not found or usernameAttribute is wrong'
+      ],
+      ldapAdminClient
     )
   }
   if (groupsSearchBase && groupClass && groupMemberAttribute) {
@@ -346,10 +535,28 @@ async function verifyUserExists(
     user.groups = groups
   }
   await ldapAdminClient.unbind()
-  return user
+  return new AuthenticationResult(
+    AUTH_RESULT_SUCCESS,
+    username,
+    user,
+    [authenticationMessages.AUTH_RESULT_SUCCESS],
+    ldapAdminClient
+  )
 }
 
 async function authenticate(options) {
+  const result = await authenticateResult(options)
+
+  if (result.code !== AUTH_RESULT_SUCCESS) {
+    throw new LdapAuthenticationError(
+      result.messages[result.messages.length - 1]
+    )
+  }
+
+  return result.user
+}
+
+async function authenticateResult(options) {
   if (!options.userDn) {
     assert(options.adminDn, 'Admin mode adminDn must be provided')
     assert(options.adminPassword, 'Admin mode adminPassword must be provided')
@@ -366,6 +573,7 @@ async function authenticate(options) {
     options.ldapOpts && options.ldapOpts.url,
     'ldapOpts.url must be provided'
   )
+
   if (options.verifyUserExists) {
     assert(options.adminDn, 'Admin mode adminDn must be provided')
     assert(
@@ -384,9 +592,11 @@ async function authenticate(options) {
       options.groupClass,
       options.groupMemberAttribute,
       options.groupMemberUserAttribute,
-      options.attributes
+      options.attributes,
+      options.explicitBufferAttributes
     )
   }
+
   assert(options.userPassword, 'userPassword must be provided')
   if (options.adminDn) {
     assert(
@@ -406,9 +616,11 @@ async function authenticate(options) {
       options.groupClass,
       options.groupMemberAttribute,
       options.groupMemberUserAttribute,
-      options.attributes
+      options.attributes,
+      options.explicitBufferAttributes
     )
   }
+
   assert(options.userDn, 'adminDn/adminPassword OR userDn must be provided')
   return await authenticateWithUser(
     options.userDn,
@@ -422,7 +634,8 @@ async function authenticate(options) {
     options.groupClass,
     options.groupMemberAttribute,
     options.groupMemberUserAttribute,
-    options.attributes
+    options.attributes,
+    options.explicitBufferAttributes
   )
 }
 
@@ -438,7 +651,21 @@ class LdapAuthenticationError extends Error {
   }
 }
 
+module.exports.AUTH_RESULT_FAILURE = AUTH_RESULT_FAILURE
+module.exports.AUTH_RESULT_SUCCESS = AUTH_RESULT_SUCCESS
+module.exports.AUTH_RESULT_FAILURE_IDENTITY_NOT_FOUND =
+  AUTH_RESULT_FAILURE_IDENTITY_NOT_FOUND
+module.exports.AUTH_RESULT_FAILURE_IDENTITY_AMBIGUOUS =
+  AUTH_RESULT_FAILURE_IDENTITY_AMBIGUOUS
+module.exports.AUTH_RESULT_FAILURE_CREDENTIAL_INVALID =
+  AUTH_RESULT_FAILURE_CREDENTIAL_INVALID
+module.exports.AUTH_RESULT_FAILURE_UNCATEGORIZED =
+  AUTH_RESULT_FAILURE_UNCATEGORIZED
+
+module.exports.AuthenticationResult = AuthenticationResult
+
 module.exports.authenticate = authenticate
+module.exports.authenticateResult = authenticateResult
 module.exports.LdapAuthenticationError = LdapAuthenticationError
 
 module.exports.exportForTesting = {

package/package.json

@@ -1,15 +1,18 @@
 {
   "name": "ldap-authentication",
-  "version": "3.3.4",
+  "version": "4.0.3",
   "description": "A simple async nodejs library for LDAP user authentication",
   "main": "index.js",
   "types": "./index.d.ts",
+  "engines": {
+    "node": ">=20.0.0"
+  },
   "scripts": {
     "test": "node test/jasmine.js"
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/shaozi/ldap-authentication.git"
+    "url": "git+https://github.com/shaozi/ldap-authentication.git"
   },
   "keywords": [
     "ldap",
@@ -36,9 +39,9 @@
   },
   "homepage": "https://github.com/shaozi/ldap-authentication#readme",
   "dependencies": {
-    "ldapts": "^7.3.1"
+    "ldapts": "^8.1.3"
   },
   "devDependencies": {
-    "jasmine": "^5.6.0"
+    "jasmine": "^6.0.0"
   }
 }

package/test/authentication-result.spec.js

@@ -0,0 +1,425 @@
+const {
+  authenticateResult,
+  AuthenticationResult,
+  AUTH_RESULT_SUCCESS,
+  AUTH_RESULT_FAILURE,
+  AUTH_RESULT_FAILURE_IDENTITY_NOT_FOUND,
+  AUTH_RESULT_FAILURE_IDENTITY_AMBIGUOUS,
+  AUTH_RESULT_FAILURE_CREDENTIAL_INVALID,
+  AUTH_RESULT_FAILURE_UNCATEGORIZED
+} = require('../index.js')
+
+const url = process.env.INGITHUB ? 'ldap://localhost:1389' : 'ldap://ldap:1389'
+
+describe('ldap-authentication test return AuthenticationResult', () => {
+  it('Use an admin user to check if user exists', async () => {
+    let options = {
+      ldapOpts: {
+        url: url,
+      },
+      adminDn: 'cn=read-only-admin,dc=example,dc=com',
+      adminPassword: 'password',
+      verifyUserExists: true,
+      userSearchBase: 'dc=example,dc=com',
+      usernameAttribute: 'uid',
+      username: 'gauss',
+    }
+
+    let result = await authenticateResult(options)
+    expect(result).toBeInstanceOf(AuthenticationResult)
+    expect(result.code).toEqual(AUTH_RESULT_SUCCESS)
+    expect(result.user).toBeTruthy()
+    expect(result.user.uid).toEqual('gauss')
+  })
+  it('Use an admin user to check if user exists and return attributes', async () => {
+    let options = {
+      ldapOpts: {
+        url: url,
+      },
+      adminDn: 'cn=read-only-admin,dc=example,dc=com',
+      adminPassword: 'password',
+      verifyUserExists: true,
+      userSearchBase: 'dc=example,dc=com',
+      usernameAttribute: 'uid',
+      username: 'gauss',
+      attributes: ['uid', 'sn'],
+    }
+
+    let result = await authenticateResult(options)
+    expect(result).toBeInstanceOf(AuthenticationResult)
+    expect(result.code).toEqual(AUTH_RESULT_SUCCESS)
+    expect(result.user).toBeTruthy()
+    expect(result.user.uid).toEqual('gauss')
+    expect(result.user.sn).toEqual('Bar1')
+    expect(result.user.cn).toBeUndefined()
+  })
+  it('Use an admin user to authenticate a regular user', async () => {
+    let options = {
+      ldapOpts: {
+        url: url,
+      },
+      adminDn: 'cn=read-only-admin,dc=example,dc=com',
+      adminPassword: 'password',
+      userPassword: 'password',
+      userSearchBase: 'dc=example,dc=com',
+      usernameAttribute: 'uid',
+      username: 'gauss',
+    }
+
+    let result = await authenticateResult(options)
+    expect(result).toBeInstanceOf(AuthenticationResult)
+    expect(result.code).toEqual(AUTH_RESULT_SUCCESS)
+    expect(result.user).toBeTruthy()
+    expect(result.user.uid).toEqual('gauss')
+  })
+  it('Use an admin user to authenticate a regular user and return attributes', async () => {
+    let options = {
+      ldapOpts: {
+        url: url,
+      },
+      adminDn: 'cn=read-only-admin,dc=example,dc=com',
+      adminPassword: 'password',
+      userPassword: 'password',
+      userSearchBase: 'dc=example,dc=com',
+      usernameAttribute: 'uid',
+      username: 'gauss',
+      attributes: ['uid', 'sn'],
+    }
+
+    let result = await authenticateResult(options)
+    expect(result).toBeInstanceOf(AuthenticationResult)
+    expect(result.code).toEqual(AUTH_RESULT_SUCCESS)
+    expect(result.user).toBeTruthy()
+    expect(result.user.uid).toEqual('gauss')
+    expect(result.user.sn).toEqual('Bar1')
+    expect(result.user.cn).toBeUndefined()
+  })
+  it('Use an regular user to authenticate iteself', async () => {
+    let options = {
+      ldapOpts: {
+        url: url,
+      },
+      userDn: 'cn=einstein,ou=users,dc=example,dc=com',
+      userPassword: 'password',
+      userSearchBase: 'dc=example,dc=com',
+      usernameAttribute: 'uid',
+      username: 'einstein',
+    }
+
+    let result = await authenticateResult(options)
+    expect(result).toBeInstanceOf(AuthenticationResult)
+    expect(result.code).toEqual(AUTH_RESULT_SUCCESS)
+    expect(result.user).toBeTruthy()
+    expect(result.user.uid).toEqual('einstein')
+  })
+  it('Use an regular user to authenticate iteself and return attributes', async () => {
+    let options = {
+      ldapOpts: {
+        url: url,
+      },
+      userDn: 'cn=einstein,ou=users,dc=example,dc=com',
+      userPassword: 'password',
+      userSearchBase: 'dc=example,dc=com',
+      usernameAttribute: 'uid',
+      username: 'einstein',
+      attributes: ['uid', 'sn'],
+    }
+
+    let result = await authenticateResult(options)
+    expect(result).toBeInstanceOf(AuthenticationResult)
+    expect(result.code).toEqual(AUTH_RESULT_SUCCESS)
+    expect(result.user).toBeTruthy()
+    expect(result.user.uid).toEqual('einstein')
+    expect(result.user.sn).toEqual('Bar2')
+    expect(result.user.cn).toBeUndefined()
+  })
+  it('Use an regular user to authenticate iteself without search', async () => {
+    let options = {
+      ldapOpts: {
+        url: url,
+      },
+      userDn: 'cn=einstein,ou=users,dc=example,dc=com',
+      userPassword: 'password',
+    }
+
+    let result = await authenticateResult(options)
+    expect(result.code).toEqual(AUTH_RESULT_SUCCESS)
+    expect(result.user).toBeTruthy()
+  })
+  it('Use an admin user to authenticate a regular user and fetch user group information', async () => {
+    let options = {
+      ldapOpts: {
+        url: url,
+      },
+      adminDn: 'cn=read-only-admin,dc=example,dc=com',
+      adminPassword: 'password',
+      userPassword: 'password',
+      userSearchBase: 'dc=example,dc=com',
+      usernameAttribute: 'uid',
+      username: 'gauss',
+      groupsSearchBase: 'dc=example,dc=com',
+      groupClass: 'groupOfNames',
+      groupMemberAttribute: 'member',
+      groupMemberUserAttribute: 'dn',
+    }
+
+    let result = await authenticateResult(options)
+    expect(result).toBeInstanceOf(AuthenticationResult)
+    expect(result.code).toEqual(AUTH_RESULT_SUCCESS)
+    expect(result.user).toBeTruthy()
+    expect(result.user.groups.length).toBeGreaterThan(0)
+    expect(result.user.groups[0].dn).toEqual('cn=科学A部,ou=groups,dc=example,dc=com')
+  })
+  it('Use regular user to authenticate and fetch user group information', async () => {
+    let options = {
+      ldapOpts: {
+        url: url,
+      },
+      userDn: 'cn=gauss,ou=users,dc=example,dc=com',
+      userPassword: 'password',
+      userSearchBase: 'dc=example,dc=com',
+      usernameAttribute: 'uid',
+      username: 'gauss',
+      groupsSearchBase: 'dc=example,dc=com',
+      groupClass: 'groupOfNames',
+      groupMemberAttribute: 'member',
+      groupMemberUserAttribute: 'dn',
+    }
+
+    let result = await authenticateResult(options)
+    expect(result).toBeInstanceOf(AuthenticationResult)
+    expect(result.code).toEqual(AUTH_RESULT_SUCCESS)
+    expect(result.user).toBeTruthy()
+    expect(result.user.groups.length).toBeGreaterThan(0)
+    expect(result.user.groups[0].dn).toEqual('cn=科学A部,ou=groups,dc=example,dc=com')
+    // backward compatible with 3.2
+    expect(result.user.groups[0].objectName).toEqual(
+      'cn=科学A部,ou=groups,dc=example,dc=com'
+    )
+  })
+  it('Not specifying groupMemberAttribute or groupMemberUserAttribute should not cause an error and fallback to default values', async () => {
+    let options = {
+      ldapOpts: {
+        url: url,
+      },
+      userDn: 'cn=gauss,ou=users,dc=example,dc=com',
+      userPassword: 'password',
+      userSearchBase: 'dc=example,dc=com',
+      usernameAttribute: 'uid',
+      username: 'gauss',
+      groupsSearchBase: 'dc=example,dc=com',
+      groupClass: 'groupOfUniqueNames',
+    }
+
+    let result = await authenticateResult(options)
+    expect(result).toBeInstanceOf(AuthenticationResult)
+    expect(result.code).toEqual(AUTH_RESULT_SUCCESS)
+    expect(result.user).toBeTruthy()
+    expect(result.user.groups.length).toBeLessThan(1)
+  })
+})
+
+describe('ldap-authentication negative test returns AuthenticationResult', () => {
+  it('wrong admin user should fail', async () => {
+    let options = {
+      ldapOpts: {
+        url: url,
+      },
+      adminDn: 'cn=not-exist,dc=example,dc=com',
+      adminPassword: 'password',
+      userPassword: 'password',
+      userSearchBase: 'dc=example,dc=com',
+      usernameAttribute: 'uid',
+      username: 'gauss',
+    }
+
+    let result = await authenticateResult(options)
+    expect(result).toBeInstanceOf(AuthenticationResult)
+    expect(result.code).toEqual(AUTH_RESULT_FAILURE)
+  })
+  it('wrong admin password should fail', async () => {
+    let options = {
+      ldapOpts: {
+        url: url,
+      },
+      adminDn: 'cn=read-only-admin,dc=example,dc=com',
+      adminPassword: 'wrongpassword',
+      userPassword: 'password',
+      userSearchBase: 'dc=example,dc=com',
+      usernameAttribute: 'uid',
+      username: 'gauss',
+    }
+
+    let result = await authenticateResult(options)
+    expect(result).toBeInstanceOf(AuthenticationResult)
+    expect(result.code).toEqual(AUTH_RESULT_FAILURE)
+  })
+  it('admin auth wrong username should fail', async () => {
+    let options = {
+      ldapOpts: {
+        url: url,
+      },
+      adminDn: 'cn=read-only-admin,dc=example,dc=com',
+      adminPassword: 'password',
+      userPassword: 'password',
+      userSearchBase: 'dc=example,dc=com',
+      usernameAttribute: 'uid',
+      username: 'wrong',
+    }
+
+    let result = await authenticateResult(options)
+    expect(result).toBeInstanceOf(AuthenticationResult)
+    expect(result.code).toEqual(AUTH_RESULT_FAILURE_IDENTITY_NOT_FOUND)
+  })
+  it('admin auth wrong user password should fail', async () => {
+    let options = {
+      ldapOpts: {
+        url: url,
+      },
+      adminDn: 'cn=read-only-admin,dc=example,dc=com',
+      adminPassword: 'password',
+      userPassword: 'wrongpassword',
+      userSearchBase: 'dc=example,dc=com',
+      usernameAttribute: 'uid',
+      username: 'gauss',
+    }
+
+    let result = await authenticateResult(options)
+    expect(result).toBeInstanceOf(AuthenticationResult)
+    expect(result.code).toEqual(AUTH_RESULT_FAILURE_CREDENTIAL_INVALID)
+  })
+  it('user auth wrong username should fail', async () => {
+    let options = {
+      ldapOpts: {
+        url: url,
+      },
+      userDn: 'cn=not-exist,dc=example,dc=com',
+      userPassword: 'password',
+      userSearchBase: 'dc=example,dc=com',
+      usernameAttribute: 'uid',
+      username: 'gauss',
+    }
+
+    let result = await authenticateResult(options)
+    expect(result).toBeInstanceOf(AuthenticationResult)
+    expect(result.code).toEqual(AUTH_RESULT_FAILURE)
+  })
+  it('user auth wrong user password should fail', async () => {
+    let options = {
+      ldapOpts: {
+        url: url,
+      },
+      userDn: 'cn=gauss,dc=example,dc=com',
+      userPassword: 'wrongpassword',
+      userSearchBase: 'dc=example,dc=com',
+      usernameAttribute: 'uid',
+      username: 'gauss',
+    }
+
+    let result = await authenticateResult(options)
+    expect(result).toBeInstanceOf(AuthenticationResult)
+    expect(result.code).toEqual(AUTH_RESULT_FAILURE)
+  })
+  it('Use an regular user to authenticate iteself without search with wrong password should fail', async () => {
+    let options = {
+      ldapOpts: {
+        url: url,
+      },
+      userDn: 'uid=einstein,dc=example,dc=com',
+      userPassword: 'wrongpassword',
+    }
+
+    let result = await authenticateResult(options)
+    expect(result).toBeInstanceOf(AuthenticationResult)
+    expect(result.code).toEqual(AUTH_RESULT_FAILURE)
+  })
+  it('Wrong attributes give failure', async () => {
+    let options = {
+      ldapOpts: {
+        url: url,
+      },
+      userDn: 'cn=einstein,ou=users,dc=example,dc=com',
+      userPassword: 'password',
+      usernameAttribute: 'wrongattribute',
+      userSearchBase: 'dc=example,dc=com',
+      username: 'einstein',
+    }
+
+    let result = await authenticateResult(options)
+    expect(result).toBeInstanceOf(AuthenticationResult)
+    expect(result.code).toEqual(AUTH_RESULT_FAILURE)
+  })
+  it('Unreachable ldap server should return failure', async () => {
+    let options = {
+      ldapOpts: {
+        url: 'ldap://x.forumsys.com',
+        connectTimeout: 2000,
+      },
+      userDn: 'uid=einstein,dc=example,dc=com',
+      userPassword: 'password',
+      usernameAttribute: 'cn',
+      userSearchBase: 'dc=example,dc=com',
+      username: 'einstein',
+    }
+
+    let result = await authenticateResult(options)
+    expect(result).toBeInstanceOf(AuthenticationResult)
+    expect(result.code).toEqual(AUTH_RESULT_FAILURE)
+  })
+  it('Unreachable ldap server should return failure (with starttls=true)', async () => {
+    let options = {
+      ldapOpts: {
+        url: 'ldap://x.forumsys.com',
+        connectTimeout: 2000,
+      },
+      userDn: 'uid=einstein,dc=example,dc=com',
+      userPassword: 'password',
+      usernameAttribute: 'cn',
+      userSearchBase: 'dc=example,dc=com',
+      username: 'einstein',
+      starttls: true,
+    }
+
+    let result = await authenticateResult(options)
+    expect(result).toBeInstanceOf(AuthenticationResult)
+    expect(result.code).toEqual(AUTH_RESULT_FAILURE)
+  })
+  it('Unmatched supplied groupMemberUserAttribute should return empty group list', async () => {
+    let options = {
+      ldapOpts: {
+        url: url,
+      },
+      userDn: 'cn=gauss,ou=users,dc=example,dc=com',
+      userPassword: 'password',
+      userSearchBase: 'dc=example,dc=com',
+      usernameAttribute: 'uid',
+      username: 'gauss',
+      groupsSearchBase: 'dc=example,dc=com',
+      groupClass: 'groupOfNames',
+      groupMemberAttribute: 'member',
+      groupMemberUserAttribute: 'dnWRONG',
+    }
+
+    let result = await authenticateResult(options)
+    expect(result).toBeInstanceOf(AuthenticationResult)
+    expect(result.user).toBeTruthy()
+    expect(result.user.groups.length).toBeLessThan(1)
+  })
+})
+
+describe('AuthenticationResult', () => {
+  it('AuthenticationResult creation and getters', async () => {
+    const result = new AuthenticationResult(
+      AUTH_RESULT_SUCCESS,
+      'testuser',
+      { cn: 'Test User' },
+      ['Authentication successful'],
+      {}
+    )
+
+    expect(result.code).toBe(AUTH_RESULT_SUCCESS)
+    expect(result.identity).toBe('testuser')
+    expect(result.user).toEqual({ cn: 'Test User' })
+    expect(result.messages).toEqual(['Authentication successful'])
+  })
+})

package/test/binary.spec.js

@@ -0,0 +1,115 @@
+const { Change } = require('ldapts')
+const { authenticate, LdapAuthenticationError } = require('../index.js')
+const ldapts = require('ldapts')
+const { Attribute } = require('ldapts')
+
+const url = process.env.INGITHUB ? 'ldap://localhost:1389' : 'ldap://ldap:1389'
+
+describe('ldap-authentication binary attributes test', () => {
+  const jpegPhotoBase64 =
+    '/9j/4AAQSkZJRgABAQEASABIAAD/2wBDACgcHiMeGSgjISMtKygwPGRBPDc3PHtYXUlkkYCZlo+AjIqgtObDoKrarYqMyP/L2u71////m8H////6/+b9//j/2wBDASstLTw1PHZBQXb4pYyl+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj/wAARCACBAGQDAREAAhEBAxEB/8QAGQAAAwEBAQAAAAAAAAAAAAAAAAECAwQF/8QALRAAAgEDAwMCBQQDAAAAAAAAAAECAxEhBBIxMkFRInEFE2GBsRU0QlJikaH/xAAXAQEBAQEAAAAAAAAAAAAAAAAAAQID/8QAGxEBAQEAAwEBAAAAAAAAAAAAAAERAhIhMUH/2gAMAwEAAhEDEQA/APMIAAKAgChp2AdwAAACBlAQUkmu5RkAAACuAAADsAZQDWQKRA7AL7gAEFCbAQDAYAAXAdwBYAogAAAAgokBgADAEr8Ab09JWqZcdq8yJpjb9Pa5qr/ROy4l6Ga6ZxfvgdoYiemqw6o49yoyAAACCiQKa4AAN9PpnWy3aP5Jbiya9ClRhBJRjby/Ji1qRqRQBMkuwMZSk2trdiys2PPqR2zaNspAAIKE0A+yA201H51TPSuSW4smvTilFJJWSOdbi0RTZQghPgK56nNwzXLXtvx4NxhiUAEABQ0nJpJcgejpkoR2rtyznWo3uRpE5S4i8hfRCrPKm0wLlUUUrgZSruXTD/oROZPISuat1s3GGRQgIKADp0kFNy8pYM2rJrshBQ4M1qNErojTOdFyjZTcfqhKWaqFPObuyAdeKlBfRhcZrT01JzXdWsXWc/U7XF5IVlqWm1waYczKhXKIKEB0aOW2uvDwZvxZ9ejbBlq+CLsZaWrMAckvSgpSW6DQVNKW6ObXRUTVd5BmuKp1M05s2USBmaABpS60Qeg41rqUXeMcszjW61auroliyi7sZaFk1YKirVnSVopyXkqajTNtSv3YouXU/oWM8nHLLZWENFCsBiaAB1aCj86tnpjlko9javBlUVY29SWO4VizNaiVBJcu/m5FJwvyFTGmqct+Como3Juz5EZrnZplLKhWAw5NDZxisW47gen8NpqOncsepmarrIBZwwOWunSf+L4ZmxqVnvI1puoU1nObs347BLS7FZLZ8x27sIwqQcJuMuUaRAGdKN5X8ZKHJu+Qrq02venpbNilnGbDB3UNXHUJ7dqmv4szfA46luVnTbf0ZNFyqUpxcKnpv2kUclWiqT9LvF8O5mtRNnZO+ChSTccAOzsGShVhSlullrhFHPObnNyfLKiAHQW2lKfngqxk3dgSyhwm4TUk3dPDIPV0OrhWltmlGr2fkxYrqrUVVg0+ez8GdHPGhLa0/uaRMFeW1K9wrd6e7vJ2XhFRjKnGqtlNtPyyTB5MrqV28nRFxnf3JgogSqp0FBKzRVZlAEKKyFCbjO6eUQexotaq6UKjtUXf+xz5ccWOmas91u2RKVjHZSlaTe210yoipqHNbY3UfyTVEI7nbyUc+r0vLiuFc1Kjz7WNItSxkmCShAAAgCeXewURbTusNBHs6LWRrpQqO1T8nOzGmtamnG1unK9gM4UknfgqNYxSzZsBuTtiOL2ZKPJ1lFU6zt0yymblRhYonuQD4KEAAOXIUkEa6f8AcQ90Sq92r2+5zioXWvY0jQqJkRXn/EeiHuywcS4NI//Z'
+
+  const baseOptions = {
+    ldapOpts: {
+      url: url,
+    },
+    adminDn: 'cn=read-only-admin,dc=example,dc=com',
+    adminPassword: 'password',
+    verifyUserExists: true,
+    userSearchBase: 'dc=example,dc=com',
+    usernameAttribute: 'uid',
+  }
+
+  it('Add jpegPhoto attribute', async () => {
+    let client = new ldapts.Client({
+      ...baseOptions.ldapOpts,
+    })
+    try {
+      await client.bind(baseOptions.adminDn, baseOptions.adminPassword)
+
+      // https://github.com/ldapts/ldapts/issues/12
+      await client.modify(
+        'cn=gauss,ou=users,dc=example,dc=com',
+        new Change({
+          operation: 'replace',
+          modification: new Attribute({
+            type: 'jpegPhoto',
+            values: [Buffer.from(jpegPhotoBase64, 'base64')],
+          }),
+        })
+      )
+    } finally {
+      await client.unbind()
+    }
+  })
+
+  it('Should return broken jpegPhoto attribute (no attribute selection nor ;binary) - But it really depends on LDAP server, it is not always true. Sometimes a buffer is returned directly.', async () => {
+    let user = await authenticate({
+      ...baseOptions,
+      username: 'gauss',
+    })
+
+    expect(user).toBeTruthy()
+    expect(user.uid).toEqual('gauss')
+    expect(user.sn).toEqual('Bar1')
+    expect(typeof user.uidNumber === 'string').toBe(true)
+    expect(user.uidNumber).toEqual('1000')
+
+    expect(user.jpegPhoto).toBeDefined()
+    // some ldap server returns a string, some ldap server returns a buffer
+    expect(
+      typeof user.jpegPhoto === 'string' || Buffer.isBuffer(user.jpegPhoto)
+    ).toBe(true)
+    if (typeof user.jpegPhoto === 'string') {
+      expect(user.jpegPhoto).not.toEqual(jpegPhotoBase64)
+    }
+    if (Buffer.isBuffer(user.jpegPhoto)) {
+      expect(
+        user.jpegPhoto.equals(Buffer.from(jpegPhotoBase64, 'base64'))
+      ).toBeTrue()
+    }
+  })
+
+  it('Should return nothing in the base64 jpegPhoto (using ;binary)', async () => {
+    let user = await authenticate({
+      ...baseOptions,
+      username: 'gauss',
+      attributes: ['uid', 'sn', 'jpegPhoto;binary'],
+    })
+
+    expect(user).toBeTruthy()
+    expect(user.uid).toEqual('gauss')
+    expect(user.sn).toEqual('Bar1')
+    expect(user.cn).toBeUndefined()
+
+    expect(user.jpegPhoto).toBeUndefined()
+
+    expect(user['jpegPhoto;binary']).toBeDefined()
+    expect(Array.isArray(user['jpegPhoto;binary'])).toBe(true)
+    expect(user['jpegPhoto;binary'].length).toBe(0)
+  })
+
+  it('Should return base64 jpegPhoto (using explicitBufferAttributes)', async () => {
+    let user = await authenticate({
+      ...baseOptions,
+      username: 'gauss',
+      attributes: ['uid', 'sn', 'jpegPhoto'],
+      explicitBufferAttributes: ['jpegPhoto'],
+    })
+
+    expect(user).toBeTruthy()
+    expect(user.uid).toEqual('gauss')
+    expect(user.sn).toEqual('Bar1')
+    expect(user.cn).toBeUndefined()
+
+    expect(user['jpegPhoto;binary']).toBeUndefined()
+
+    expect(user.jpegPhoto).toBeDefined()
+    expect(typeof user.jpegPhoto === 'string').toBe(true)
+    expect(user.jpegPhoto).toEqual(jpegPhotoBase64)
+
+    const buffer = Buffer.from(user.jpegPhoto, 'base64')
+    expect(buffer).toBeDefined()
+    expect(buffer.length).toBeGreaterThan(0)
+  })
+})

package/test/starttls.spec.js

@@ -0,0 +1,126 @@
+const { authenticate, LdapAuthenticationError } = require('../index.js')
+
+const url = process.env.INGITHUB ? 'ldap://localhost:1389' : 'ldap://ldap:1389'
+
+describe('ldap-authentication StartTLS and TLS options test', () => {
+  it('Plain LDAP with tlsOptions in ldapOpts should work (ldap:// protocol)', async () => {
+    // Regression test: Before fix, having tlsOptions with ldap:// URL caused issues
+    // After fix: tlsOptions are properly excluded from Client constructor for ldap:// URLs
+    let options = {
+      ldapOpts: {
+        url: url,
+        tlsOptions: {
+          rejectUnauthorized: false,
+        },
+      },
+      adminDn: 'cn=read-only-admin,dc=example,dc=com',
+      adminPassword: 'password',
+      userPassword: 'password',
+      userSearchBase: 'dc=example,dc=com',
+      usernameAttribute: 'uid',
+      username: 'gauss',
+    }
+
+    let user = await authenticate(options)
+    expect(user).toBeTruthy()
+    expect(user.uid).toEqual('gauss')
+  })
+
+  it('Use an admin user to authenticate with StartTLS (may skip if TLS not configured)', async () => {
+    // Note: This test may not fully succeed if the LDAP server lacks TLS certificates
+    // However, it should NOT fail with the original ECONNRESET bug
+    let options = {
+      ldapOpts: {
+        url: url,
+        tlsOptions: {
+          rejectUnauthorized: false,
+          minVersion: 'TLSv1.2',
+        },
+      },
+      starttls: true,
+      adminDn: 'cn=read-only-admin,dc=example,dc=com',
+      adminPassword: 'password',
+      userPassword: 'password',
+      userSearchBase: 'dc=example,dc=com',
+      usernameAttribute: 'uid',
+      username: 'gauss',
+    }
+
+    try {
+      let user = await authenticate(options)
+      // If this succeeds, StartTLS is fully working!
+      expect(user).toBeTruthy()
+      expect(user.uid).toEqual('gauss')
+    } catch (error) {
+      // Expected if StartTLS is not configured on the server
+      // The critical check: should NOT be the original ECONNRESET bug
+      if (error.code === 'ECONNRESET' && 
+          error.message && error.message.includes('Client network socket disconnected before secure TLS connection')) {
+        fail('ECONNRESET bug detected: tlsOptions should NOT be passed to Client constructor when using ldap:// URL')
+      }
+      // Other errors are acceptable (e.g., server doesn't support StartTLS)
+      expect(error).toBeTruthy()
+    }
+  })
+
+  it('Use a regular user to authenticate with StartTLS (self mode)', async () => {
+    let options = {
+      ldapOpts: {
+        url: url,
+        tlsOptions: {
+          rejectUnauthorized: false,
+          minVersion: 'TLSv1.2',
+        },
+      },
+      starttls: true,
+      userDn: 'cn=einstein,ou=users,dc=example,dc=com',
+      userPassword: 'password',
+      userSearchBase: 'dc=example,dc=com',
+      usernameAttribute: 'uid',
+      username: 'einstein',
+    }
+
+    try {
+      let user = await authenticate(options)
+      expect(user).toBeTruthy()
+      expect(user.uid).toEqual('einstein')
+    } catch (error) {
+      if (error.code === 'ECONNRESET' && 
+          error.message && error.message.includes('Client network socket disconnected before secure TLS connection')) {
+        fail('ECONNRESET bug detected: tlsOptions should NOT be passed to Client constructor when using ldap:// URL')
+      }
+      expect(error).toBeTruthy()
+    }
+  })
+
+  it('Verify user exists with StartTLS', async () => {
+    let options = {
+      ldapOpts: {
+        url: url,
+        tlsOptions: {
+          rejectUnauthorized: false,
+          minVersion: 'TLSv1.2',
+        },
+      },
+      starttls: true,
+      adminDn: 'cn=read-only-admin,dc=example,dc=com',
+      adminPassword: 'password',
+      verifyUserExists: true,
+      userSearchBase: 'dc=example,dc=com',
+      usernameAttribute: 'uid',
+      username: 'gauss',
+    }
+
+    try {
+      let user = await authenticate(options)
+      expect(user).toBeTruthy()
+      expect(user.uid).toEqual('gauss')
+    } catch (error) {
+      if (error.code === 'ECONNRESET' && 
+          error.message && error.message.includes('Client network socket disconnected before secure TLS connection')) {
+        fail('ECONNRESET bug detected: tlsOptions should NOT be passed to Client constructor when using ldap:// URL')
+      }
+      expect(error).toBeTruthy()
+    }
+  })
+})

package/test/test.spec.js

@@ -144,7 +144,7 @@ describe('ldap-authentication test', () => {
     let user = await authenticate(options)
     expect(user).toBeTruthy()
     expect(user.groups.length).toBeGreaterThan(0)
-    expect(user.groups[0].dn).toEqual('cn=科学A部,ou=users,dc=example,dc=com')
+    expect(user.groups[0].dn).toEqual('cn=科学A部,ou=groups,dc=example,dc=com')
   })
   it('Use regular user to authenticate and fetch user group information', async () => {
     let options = {
@@ -165,10 +165,10 @@ describe('ldap-authentication test', () => {
     let user = await authenticate(options)
     expect(user).toBeTruthy()
     expect(user.groups.length).toBeGreaterThan(0)
-    expect(user.groups[0].dn).toEqual('cn=科学A部,ou=users,dc=example,dc=com')
+    expect(user.groups[0].dn).toEqual('cn=科学A部,ou=groups,dc=example,dc=com')
     // backward compatible with 3.2
     expect(user.groups[0].objectName).toEqual(
-      'cn=科学A部,ou=users,dc=example,dc=com'
+      'cn=科学A部,ou=groups,dc=example,dc=com'
     )
   })
   it('Not specifying groupMemberAttribute or groupMemberUserAttribute should not cause an error and fallback to default values', async () => {