ldap-authentication 4.0.4 → 4.1.0

package/.devcontainer/docker-compose.yml

@@ -8,14 +8,13 @@ services:
     command: sleep infinity
 
   ldap:
-    image: symas/openldap:2.6
+    build:
+      context: ..
+      dockerfile: docker/ldap/Dockerfile
     ports:
-      - '1389:1389'
-      - '1636:1636'
+      - '1389:389'
+      - '1636:636'
     environment:
-      - LDAP_ROOT=dc=example,dc=com
-      - LDAP_ADMIN_USERNAME=read-only-admin
+      - LDAP_DOMAIN=example.com
       - LDAP_ADMIN_PASSWORD=password
-      - LDAP_USERS=gauss,einstein
-      - LDAP_PASSWORDS=password,password
-      - LDAP_GROUP=科学A部
+      - LDAP_TLS=true

package/.github/workflows/publish.yml

@@ -0,0 +1,53 @@
+name: 'Publish to npm'
+
+env:
+  INGITHUB: true
+
+on:
+  release:
+    types: [created]
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    name: 'Publish ${{ github.ref_name }}'
+
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Install LDAP tools
+        run: sudo apt-get install -y ldap-utils
+
+      - name: Start containers
+        run: docker compose -f "docker-compose.yml" up -d
+
+      - name: Wait for LDAP server to become available
+        uses: nick-fields/retry@v2
+        with:
+          timeout_minutes: 5
+          max_attempts: 10
+          polling_interval_seconds: 3
+          command: |
+            ldapsearch -LLL -o 'ldif-wrap=no' \
+              -H ldap://localhost:1389 \
+              -D 'cn=read-only-admin,dc=example,dc=com' \
+              -w password \
+              -b 'cn=einstein,ou=users,dc=example,dc=com' DN
+
+      - name: Use Node.js 22.x
+        uses: actions/setup-node@v3
+        with:
+          node-version: 22.x
+          registry-url: 'https://registry.npmjs.org'
+
+      - run: npm ci
+      - run: npm run test
+
+      - name: Stop containers
+        if: always()
+        run: docker compose -f "docker-compose.yml" down
+
+      - name: Publish to npm
+        run: npm publish
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

package/README.md

@@ -25,7 +25,11 @@ This library use `ldapts` as the underneath library. It has three modes of authe
    then does a search on the user and return the user's details.
 
 3. **Verify user exists**. If an `verifyUserExists : true` is provided, the library will login (ldap bind) with the admin user,
-   then search for the user to be verified. If the user exists, user details will be returned (without verifying the user's password).
+    then search for the user to be verified. If the user exists, user details will be returned (without verifying the user's password).
+
+In addition, the `fetchUsers()` function can be used to fetch all users under a search base, using the admin
+account to search (without any username or password of the individual users). The search always uses
+LDAP paged results, so the common server-side limit of 1000 entries per search does not apply.
 
 ## Features
 
@@ -102,8 +106,32 @@ let authenticated = await authenticate({
 })
 ```
 
+#### Fetch all users (admin search, without user passwords)
+
+```javascript
+const { fetchUsers } = require('ldap-authentication')
+
+let users = await fetchUsers({
+  ldapOpts: { url: 'ldap://ldap.forumsys.com' },
+  adminDn: 'cn=read-only-admin,dc=example,dc=com',
+  adminPassword: 'password',
+  userSearchBase: 'dc=example,dc=com',
+  // userFilter: '(objectClass=person)',  // default: (|(uid=*)(sAMAccountName=*))
+  // attributes: ['uid', 'sn', 'mail'],   // omitted = all attributes
+  // pageSize: 500,                       // default: 1000
+})
+```
+
 #### Complete example
 
+The library works with both CommonJS and ES modules:
+
+```javascript
+import { authenticate } from 'ldap-authentication'
+// or
+const { authenticate } = require('ldap-authentication')
+```
+
 ```javascript
 const { authenticate } = require('ldap-authentication')
 
@@ -204,9 +232,18 @@ auth()
   if this value is not set, then authenticate will return true right after user bind succeed. No user details
   from LDAP search will be performed and returned.
   Example: `uid`
+- `usernameFilter`: Prioritized alternative to usernameAttribute, allows you to provide a filter where `{{username}}` will 
+  be replaced with the username provided
+  Example: `(|(uid={{username}})(mail={{username}}))`
 - `username`: The username to authenticate with. It is used together with the name in `usernameAttribute`
   to construct an ldap filter as `({attribute}={username})`
   to find the user and get user details in LDAP. Example: `some user input`
+- `userFilter`: (used by `fetchUsers()`) The ldap search filter to select the users to return.
+  By default it is `(|(uid=*)(sAMAccountName=*))`, which matches both POSIX (`uid`)
+  and Active Directory (`sAMAccountName`) users. Example: `'(objectClass=person)'`,
+  or `'(objectClass=*)'` to match everything
+- `pageSize`: (used by `fetchUsers()`) The number of entries to fetch per page for the paged
+  search. Default: `1000`
 - `attributes`: A list of attributes of a user details to be returned from the LDAP server.
   If is set to `[]` or ommited, all details will be returned. Example: `['sn', 'cn']`
 - `starttls`: Boolean. Use `STARTTLS` or not. When `true`, the connection will be upgraded to TLS
@@ -223,6 +260,8 @@ The user object if `authenticate()` is success.
 
 In version 4, a new function is added: `authenticateResult()`. It has the same call signature as `authenticate()` but returns an object `AuthenticationResult` with more details.
 
+`fetchUsers()` returns an array of user objects, one per matched LDAP entry (each with its `dn` and the returned attributes), or an empty array if no user matches the filter.
+
 
 ### AuthenticationResult Object
 

package/docker/ldap/10-ldap-test-data.ldif

@@ -0,0 +1,47 @@
+# Test directory seed data for ldap-authentication integration tests.
+# Loaded by osixia/openldap at first start via
+# /container/service/slapd/assets/config/bootstrap/ldif/custom
+# (directory bind-mounted in docker-compose.yml).
+# See https://github.com/osixia/container-openldap (v1, tag 1.5.0)
+
+dn: ou=users,dc=example,dc=com
+objectClass: organizationalUnit
+ou: users
+
+dn: ou=groups,dc=example,dc=com
+objectClass: organizationalUnit
+ou: groups
+
+dn: cn=read-only-admin,dc=example,dc=com
+objectClass: simpleSecurityObject
+objectClass: organizationalRole
+cn: read-only-admin
+description: LDAP admin user for tests (password: password)
+userPassword: {SSHA}u/l8yXCyiWhP3iXpt0UWMyM9ch5sZGFwLXRlc3QtMjAyNg==
+
+dn: cn=gauss,ou=users,dc=example,dc=com
+objectClass: inetOrgPerson
+objectClass: posixAccount
+cn: gauss
+sn: Bar1
+uid: gauss
+uidNumber: 1000
+gidNumber: 1000
+homeDirectory: /home/gauss
+userPassword: {SSHA}u/l8yXCyiWhP3iXpt0UWMyM9ch5sZGFwLXRlc3QtMjAyNg==
+
+dn: cn=einstein,ou=users,dc=example,dc=com
+objectClass: inetOrgPerson
+objectClass: posixAccount
+cn: einstein
+sn: Bar2
+uid: einstein
+uidNumber: 1001
+gidNumber: 1001
+homeDirectory: /home/einstein
+userPassword: {SSHA}u/l8yXCyiWhP3iXpt0UWMyM9ch5sZGFwLXRlc3QtMjAyNg==
+
+dn: cn=科学A部,ou=groups,dc=example,dc=com
+objectClass: groupOfNames
+cn: 科学A部
+member: cn=gauss,ou=users,dc=example,dc=com

package/docker/ldap/20-ldap-test-acl.ldif

@@ -0,0 +1,21 @@
+# ACLs for the test LDAP directory, applied on top of the osixia/openldap
+# defaults (replaces the data database access rules at first start).
+#
+# The userPassword rule must come before the generic "to *" rule: OpenLDAP
+# evaluates the first matching "to" clause for an attribute.
+#
+#  - EXTERNAL (slapd local socket): full manage (used by the image bootstrap)
+#  - cn=admin,dc=example,dc=com: full manage
+#  - cn=read-only-admin,dc=example,dc=com: full manage (tests use it as the
+#    admin, including the entry modify in binary.spec.js)
+#  - normal users: read own entry and read group entries (group lookup tests)
+#  - anonymous: no access (simple bind does not consult other ACLs)
+
+dn: olcDatabase={1}mdb,cn=config
+changetype: modify
+delete: olcAccess
+-
+add: olcAccess
+olcAccess: to attrs=userPassword,shadowLastChange by self write by dn="cn=admin,dc=example,dc=com" manage by dn.exact="cn=read-only-admin,dc=example,dc=com" manage by anonymous auth by * none
+olcAccess: to dn.subtree="ou=groups,dc=example,dc=com" by users read by dn.exact="cn=read-only-admin,dc=example,dc=com" read by dn="cn=admin,dc=example,dc=com" manage
+olcAccess: to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage by dn="cn=admin,dc=example,dc=com" manage by dn.exact="cn=read-only-admin,dc=example,dc=com" manage by users read by self read by * none

package/docker/ldap/Dockerfile

@@ -0,0 +1,7 @@
+FROM osixia/openldap:1.5.0
+
+# Seed the test directory (dc=example,dc=com) with the users, groups and
+# admin account used by the integration tests, and grant the test admin
+# (cn=read-only-admin) the rights it needs. Files are applied by the
+# osixia/openldap bootstrap at the container's first start.
+COPY docker/ldap/10-ldap-test-data.ldif docker/ldap/20-ldap-test-acl.ldif /container/service/slapd/assets/config/bootstrap/ldif/custom/

package/docker-compose.yml

@@ -1,13 +1,15 @@
 services:
   ldap:
-    image: symas/openldap:2.6
+    # LDAP server used by the integration tests, based on osixia/openldap.
+    # The Dockerfile in docker/ldap/ seeds the directory with the users,
+    # groups and admin account the tests rely on.
+    build:
+      context: .
+      dockerfile: docker/ldap/Dockerfile
     ports:
-      - '1389:1389'
-      - '1636:1636'
+      - '1389:389'
+      - '1636:636'
     environment:
-      - LDAP_ROOT=dc=example,dc=com
-      - LDAP_ADMIN_USERNAME=read-only-admin
+      - LDAP_DOMAIN=example.com
       - LDAP_ADMIN_PASSWORD=password
-      - LDAP_USERS=gauss,einstein
-      - LDAP_PASSWORDS=password,password
-      - LDAP_GROUP=科学A部
+      - LDAP_TLS=true

package/index.d.ts

@@ -8,6 +8,7 @@ declare module 'ldap-authentication' {
     adminPassword?: string
     userSearchBase?: string
     usernameAttribute?: string
+    usernameFilter?:string
     username?: string
     verifyUserExists?: boolean
     starttls?: boolean
@@ -36,9 +37,37 @@ declare module 'ldap-authentication' {
     readonly client: any
   }
 
+  export interface FetchUsersOptions {
+    ldapOpts: ClientOptions
+    adminDn: string
+    adminPassword: string
+    userSearchBase: string
+    /**
+     * LDAP search filter used to select the users to return.
+     * Defaults to `(|(uid=*)(sAMAccountName=*))`, which matches both
+     * POSIX (`uid`) and Active Directory (`sAMAccountName`) users.
+     * Example: `'(objectClass=person)'`, or `'(objectClass=*)'` to match everything.
+     */
+    userFilter?: string
+    /** A list of attributes of the users to be returned from the LDAP server. If omitted, all details will be returned. */
+    attributes?: string[]
+    /** A list of attributes to be returned as base64-encoded strings. */
+    explicitBufferAttributes?: string[]
+    /** Number of entries to fetch per page for the paged search. Defaults to 1000. */
+    pageSize?: number
+    starttls?: boolean
+  }
+
   export function authenticate(options: AuthenticationOptions): Promise<any>
   export function authenticateResult(options: AuthenticationOptions): Promise<AuthenticationResult>
 
+  /**
+   * Bind with the admin account and search all users under `userSearchBase`.
+   * The search always uses paged results, so results are not limited by the
+   * common server-side limit of 1000 entries.
+   */
+  export function fetchUsers(options: FetchUsersOptions): Promise<any[]>
+
   export class LdapAuthenticationError extends Error {
     constructor(message: any)
     name: string

package/index.js

@@ -45,6 +45,9 @@ const AUTH_RESULT_FAILURE_IDENTITY_AMBIGUOUS = -2
 const AUTH_RESULT_FAILURE_CREDENTIAL_INVALID = -3
 const AUTH_RESULT_FAILURE_UNCATEGORIZED = -4
 
+const DEFAULT_FETCH_USERS_FILTER = '(|(uid=*)(sAMAccountName=*))'
+const DEFAULT_FETCH_USERS_PAGE_SIZE = 1000
+
 class AuthenticationResult {
   #authCode = AUTH_RESULT_FAILURE_UNCATEGORIZED
   #identity
@@ -124,19 +127,30 @@ async function _ldapBind(dn, password, starttls, ldapOpts) {
   return client
 }
 
+// replace username in filter
+
+
 // search a user and return the object
 async function _searchUser(
   ldapClient,
   searchBase,
+  usernameFilter,
   usernameAttribute,
   username,
   attributes = null,
   explicitBufferAttributes = null
 ) {
-  let filter = new ldapts.EqualityFilter({
-    attribute: usernameAttribute,
-    value: username,
-  })
+  let filter;
+  if(usernameFilter){
+    filter = usernameFilter.replaceAll("{{username}}",username.replaceAll(/[&|!*()]/g,""));
+  }
+  else{
+    filter = new ldapts.EqualityFilter({
+      attribute: usernameAttribute,
+      value: username,
+    })
+  }
+  
   let searchOptions = {
     filter: filter,
     scope: 'sub',
@@ -262,10 +276,60 @@ async function _searchUserGroups(
   return groups
 }
 
+// search all users under the search base and return the list of user objects
+async function _fetchAllUsers(
+  ldapClient,
+  searchBase,
+  userFilter,
+  attributes = null,
+  explicitBufferAttributes = null,
+  pageSize = DEFAULT_FETCH_USERS_PAGE_SIZE
+) {
+  let filter = userFilter || DEFAULT_FETCH_USERS_FILTER
+
+  let searchOptions = {
+    filter: filter,
+    scope: 'sub',
+    // always use paged results, so more than the usual server-side limit
+    // (usually 1000 entries per page) can be returned
+    paged: { pageSize: pageSize },
+  }
+  if (attributes) {
+    searchOptions.attributes = attributes
+  }
+  if (explicitBufferAttributes) {
+    searchOptions.explicitBufferAttributes = explicitBufferAttributes
+  }
+
+  const { searchEntries } = await ldapClient.search(searchBase, searchOptions)
+
+  let users = searchEntries || []
+  // when attribute endwith ;binary, ldapts returns Buffer, we convert them into base64 string
+  for (let user of users) {
+    if (user != null && attributes != null) {
+      for (let attr of attributes) {
+        if (attr.endsWith(';binary') && Buffer.isBuffer(user[attr])) {
+          user[attr] = user[attr].toString('base64')
+        }
+      }
+    }
+    // when attribute is one of the explicitBufferAttributes, should convert to base64 string
+    if (user != null && explicitBufferAttributes != null) {
+      for (let attr of explicitBufferAttributes) {
+        if (Buffer.isBuffer(user[attr])) {
+          user[attr] = user[attr].toString('base64')
+        }
+      }
+    }
+  }
+  return users
+}
+
 async function authenticateWithAdmin(
   adminDn,
   adminPassword,
   userSearchBase,
+  usernameFilter,
   usernameAttribute,
   username,
   userPassword,
@@ -303,6 +367,7 @@ async function authenticateWithAdmin(
   let searchResult = await _searchUser(
     ldapAdminClient,
     userSearchBase,
+    usernameFilter,
     usernameAttribute,
     username,
     attributes,
@@ -368,6 +433,7 @@ async function authenticateWithAdmin(
 async function authenticateWithUser(
   userDn,
   userSearchBase,
+  usernameFilter,
   usernameAttribute,
   username,
   userPassword,
@@ -411,6 +477,7 @@ async function authenticateWithUser(
   let searchResult = await _searchUser(
     ldapUserClient,
     userSearchBase,
+    usernameFilter,
     usernameAttribute,
     username,
     attributes,
@@ -463,6 +530,7 @@ async function verifyUserExists(
   adminDn,
   adminPassword,
   userSearchBase,
+  usernameFilter,
   usernameAttribute,
   username,
   starttls,
@@ -498,6 +566,7 @@ async function verifyUserExists(
   let searchResult = await _searchUser(
     ldapAdminClient,
     userSearchBase,
+    usernameFilter,
     usernameAttribute,
     username,
     attributes,
@@ -544,6 +613,51 @@ async function verifyUserExists(
   )
 }
 
+// fetch all users under the search base, using the admin account to search.
+// the search always uses paged results so the common server-side limit of
+// 1000 entries does not apply.
+async function fetchUsers(options) {
+  assert(
+    options.ldapOpts && options.ldapOpts.url,
+    'fetchUsers: ldapOpts.url must be provided'
+  )
+  assert(options.adminDn, 'fetchUsers: adminDn must be provided')
+  assert(options.adminPassword, 'fetchUsers: adminPassword must be provided')
+  assert(options.userSearchBase, 'fetchUsers: userSearchBase must be provided')
+
+  let ldapAdminClient
+  try {
+    ldapAdminClient = await _ldapBind(
+      options.adminDn,
+      options.adminPassword,
+      options.starttls,
+      options.ldapOpts
+    )
+  } catch (error) {
+    if (ldapAdminClient && ldapAdminClient.isConnected) {
+      await ldapAdminClient.unbind()
+    }
+    throw new LdapAuthenticationError(error.message || 'admin bind failed')
+  }
+
+  try {
+    return await _fetchAllUsers(
+      ldapAdminClient,
+      options.userSearchBase,
+      options.userFilter,
+      options.attributes,
+      options.explicitBufferAttributes,
+      options.pageSize || DEFAULT_FETCH_USERS_PAGE_SIZE
+    )
+  } catch (error) {
+    throw new LdapAuthenticationError(error.message || 'user search failed')
+  } finally {
+    if (ldapAdminClient && ldapAdminClient.isConnected) {
+      await ldapAdminClient.unbind()
+    }
+  }
+}
+
 async function authenticate(options) {
   const result = await authenticateResult(options)
 
@@ -562,8 +676,8 @@ async function authenticateResult(options) {
     assert(options.adminPassword, 'Admin mode adminPassword must be provided')
     assert(options.userSearchBase, 'Admin mode userSearchBase must be provided')
     assert(
-      options.usernameAttribute,
-      'Admin mode usernameAttribute must be provided'
+      options.usernameAttribute || options.usernameFilter,
+      'Admin mode usernameAttribute or usernameFilter must be provided'
     )
     assert(options.username, 'Admin mode username must be provided')
   } else {
@@ -584,6 +698,7 @@ async function authenticateResult(options) {
       options.adminDn,
       options.adminPassword,
       options.userSearchBase,
+      options.usernameFilter,
       options.usernameAttribute,
       options.username,
       options.starttls,
@@ -607,6 +722,7 @@ async function authenticateResult(options) {
       options.adminDn,
       options.adminPassword,
       options.userSearchBase,
+      options.usernameFilter,
       options.usernameAttribute,
       options.username,
       options.userPassword,
@@ -625,6 +741,7 @@ async function authenticateResult(options) {
   return await authenticateWithUser(
     options.userDn,
     options.userSearchBase,
+    options.usernameFilter,
     options.usernameAttribute,
     options.username,
     options.userPassword,
@@ -666,6 +783,7 @@ module.exports.AuthenticationResult = AuthenticationResult
 
 module.exports.authenticate = authenticate
 module.exports.authenticateResult = authenticateResult
+module.exports.fetchUsers = fetchUsers
 module.exports.LdapAuthenticationError = LdapAuthenticationError
 
 module.exports.exportForTesting = {

package/index.mjs

@@ -0,0 +1,17 @@
+import ldapAuthentication from './index.js'
+
+export {
+  AUTH_RESULT_FAILURE,
+  AUTH_RESULT_FAILURE_CREDENTIAL_INVALID,
+  AUTH_RESULT_FAILURE_IDENTITY_AMBIGUOUS,
+  AUTH_RESULT_FAILURE_IDENTITY_NOT_FOUND,
+  AUTH_RESULT_FAILURE_UNCATEGORIZED,
+  AUTH_RESULT_SUCCESS,
+  AuthenticationResult,
+  LdapAuthenticationError,
+  authenticate,
+  authenticateResult,
+  fetchUsers,
+} from './index.js'
+
+export default ldapAuthentication

package/package.json

@@ -1,9 +1,18 @@
 {
   "name": "ldap-authentication",
-  "version": "4.0.4",
+  "version": "4.1.0",
   "description": "A simple async nodejs library for LDAP user authentication",
   "main": "index.js",
   "types": "./index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./index.d.ts",
+      "import": "./index.mjs",
+      "require": "./index.js",
+      "default": "./index.js"
+    },
+    "./package.json": "./package.json"
+  },
   "engines": {
     "node": ">=20.0.0"
   },

package/test/fetch-users.spec.js

@@ -0,0 +1,136 @@
+const { fetchUsers, LdapAuthenticationError } = require('../index.js')
+
+const url = process.env.INGITHUB ? 'ldap://localhost:1389' : 'ldap://ldap:1389'
+
+describe('ldap-authentication fetchUsers test', () => {
+  const baseOptions = {
+    ldapOpts: {
+      url: url,
+    },
+    adminDn: 'cn=read-only-admin,dc=example,dc=com',
+    adminPassword: 'password',
+    userSearchBase: 'dc=example,dc=com',
+  }
+
+  it('Should return all users with the default filter', async () => {
+    let users = await fetchUsers(baseOptions)
+
+    expect(Array.isArray(users)).toBe(true)
+    expect(users.length).toBe(2)
+    let uids = users.map((user) => user.uid)
+    expect(uids).toContain('gauss')
+    expect(uids).toContain('einstein')
+    for (let user of users) {
+      expect(user.dn).toBeTruthy()
+    }
+  })
+
+  it('Should return only the requested attributes', async () => {
+    let users = await fetchUsers({
+      ...baseOptions,
+      attributes: ['uid', 'sn'],
+    })
+
+    expect(users.length).toBe(2)
+    let gauss = users.find((user) => user.uid === 'gauss')
+    expect(gauss).toBeTruthy()
+    expect(gauss.sn).toEqual('Bar1')
+    expect(gauss.cn).toBeUndefined()
+  })
+
+  it('Should return only matching users with a custom userFilter', async () => {
+    let users = await fetchUsers({
+      ...baseOptions,
+      userFilter: '(uid=gauss)',
+    })
+
+    expect(users.length).toBe(1)
+    expect(users[0].uid).toEqual('gauss')
+    expect(users[0].sn).toEqual('Bar1')
+  })
+
+  it('Should return all entries including non-users when userFilter matches everything', async () => {
+    let users = await fetchUsers({
+      ...baseOptions,
+      userFilter: '(objectClass=*)',
+    })
+
+    expect(users.length).toBeGreaterThan(2)
+    let dns = users.map((user) => user.dn)
+    expect(dns).toContain('cn=gauss,ou=users,dc=example,dc=com')
+    expect(dns).toContain('cn=科学A部,ou=groups,dc=example,dc=com')
+  })
+
+  it('Should return empty list when userFilter matches nothing', async () => {
+    let users = await fetchUsers({
+      ...baseOptions,
+      userFilter: '(uid=does-not-exist)',
+    })
+
+    expect(users).toEqual([])
+  })
+})
+
+describe('ldap-authentication fetchUsers negative test', () => {
+  const baseOptions = {
+    ldapOpts: {
+      url: url,
+    },
+    adminDn: 'cn=read-only-admin,dc=example,dc=com',
+    adminPassword: 'password',
+    userSearchBase: 'dc=example,dc=com',
+  }
+
+  it('wrong admin password should throw LdapAuthenticationError', async () => {
+    let options = {
+      ...baseOptions,
+      adminPassword: 'wrongpassword',
+    }
+
+    let e = null
+    try {
+      await fetchUsers(options)
+    } catch (error) {
+      e = error
+    }
+
+    expect(e).toBeTruthy()
+    expect(e).toBeInstanceOf(LdapAuthenticationError)
+  })
+
+  it('wrong admin dn should throw LdapAuthenticationError', async () => {
+    let options = {
+      ...baseOptions,
+      adminDn: 'cn=not-exist,dc=example,dc=com',
+    }
+
+    let e = null
+    try {
+      await fetchUsers(options)
+    } catch (error) {
+      e = error
+    }
+
+    expect(e).toBeTruthy()
+    expect(e).toBeInstanceOf(LdapAuthenticationError)
+  })
+
+  it('missing userSearchBase should throw', async () => {
+    let options = {
+      ldapOpts: {
+        url: url,
+      },
+      adminDn: 'cn=read-only-admin,dc=example,dc=com',
+      adminPassword: 'password',
+    }
+
+    let e = null
+    try {
+      await fetchUsers(options)
+    } catch (error) {
+      e = error
+    }
+
+    expect(e).toBeTruthy()
+  })
+})