From b70d9f1a829267c5a607452b50dadbd4fc2519da Mon Sep 17 00:00:00 2001
From: Ruben Talstra <RubenTalstra1211@outlook.com>
Date: Fri, 21 Mar 2025 12:55:09 +0100
Subject: [PATCH] =?UTF-8?q?=F0=9F=9A=80=20feat:=20Add=20support=20for=20LD?=
 =?UTF-8?q?AP=20STARTTLS=20in=20LDAP=20Auth=20(#6438)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .env.example                   | 1 +
 api/strategies/ldapStrategy.js | 3 +++
 2 files changed, 4 insertions(+)

diff --git a/.env.example b/.env.example
index 54f9c4a96c..70793a7236 100644
--- a/.env.example
+++ b/.env.example
@@ -444,6 +444,7 @@ LDAP_USER_SEARCH_BASE=
 LDAP_SEARCH_FILTER=mail={{username}}
 LDAP_CA_CERT_PATH=
 # LDAP_TLS_REJECT_UNAUTHORIZED=
+# LDAP_STARTTLS=
 # LDAP_LOGIN_USES_USERNAME=true
 # LDAP_ID=
 # LDAP_USERNAME=
diff --git a/api/strategies/ldapStrategy.js b/api/strategies/ldapStrategy.js
index 4a2c1b827b..5ec279b982 100644
--- a/api/strategies/ldapStrategy.js
+++ b/api/strategies/ldapStrategy.js
@@ -18,6 +18,7 @@ const {
   LDAP_USERNAME,
   LDAP_EMAIL,
   LDAP_TLS_REJECT_UNAUTHORIZED,
+  LDAP_STARTTLS,
 } = process.env;
 
 // Check required environment variables
@@ -50,6 +51,7 @@ if (LDAP_EMAIL) {
   searchAttributes.push(LDAP_EMAIL);
 }
 const rejectUnauthorized = isEnabled(LDAP_TLS_REJECT_UNAUTHORIZED);
+const startTLS = isEnabled(LDAP_STARTTLS);
 
 const ldapOptions = {
   server: {
@@ -72,6 +74,7 @@ const ldapOptions = {
         })(),
       },
     }),
+    ...(startTLS && { starttls: true }),
   },
   usernameField: 'email',
   passwordField: 'password',