Search code examples
node.jsexpressldap

LDAPJS Error: 'Operations Error' when assigning groups to users in Express.js backend

I'm trying to assign a group to a user in my Express.js backend using LDAPS (3.0.3).

The logic for this operation lies within the updateUserGroup() function.

I followed this tutorial, but I got the following error, and I can't seem to find any relevant information in the LDAPJS documentation.

"error": "Operations Error"

Stack: Express.js, LDAPJS module.

If anyone knows a more effective approach to perform CRUD operations on Active Directory from Express.js, I'm open to suggestions.

async function setupclient(): Promise<ldap.Client> {
   const client = ldap.createClient({
      url: 'LDAPS://example.com:636',
      tlsOptions: {
         rejectUnauthorized: true,
         cert: fs.readFileSync('x.pem'),
         ca: fs.readFileSync('xx.pem'),
      },
      reconnect: false,
   });

   const username = process.env.LDAP_USERNAME;
   const password = process.env.LDAP_PASSWORD;
   try {
      await new Promise((resolve, reject) => {
         client.bind(username, password, (err) => {
            if (err) {
               console.error('LDAP bind error:', err);
               reject(new Error(`LDAP bind error: ${err}`));
            } else {
               console.log('Connected to LDAP');
               resolve(true);
            }
         });
      });
   } catch (err) {
      client.unbind();
      throw err;
   }

   return client;
}
async function updateUserGroup({ pid, dn, gn }: UpdateUser): Promise<any> {
   try {
      const client = await setupclient();

      const change = new ldap.Change({
         operation: 'add',
         modification: {
            type: 'member',
            values: ['CN=sara,OU=Portal,OU=Users,OU=Perm2,OU=Bassmor,DC=example,DC=com'],
         },
      });
      return new Promise((resolve, reject) => {
         client.modify(
            'CN=SuperCoolUsers,OU=Portal,OU=Accrom,OU=Portal,OU=Groups,OU=Perm2,OU=Bassmor,DC=example,DC=com',
            change,
            (err) => {
               if (err) {
                  console.log(err);
                  reject(new Error(err.message));
               } else {
                  console.log('la til i gruppe %j', null);
                  resolve(null);
               }
            }
         );
      });
   } catch (error: any) {
      console.error('updateUserGroup error:', error);
      throw new Error(error.message);
   }
}

Answer to @Gabriel Luci

Thanks. I did do it that way initially, but somehow managed to upload the wrong snippet. I updated my question to the correct change now.

This resulted in a new error: "No Such Object." However, I am confident that the path is correct because I copied the "DN" from ADSI-Edit on Windows, which is connected to the same LDAPS-server as my Express.js backend, with the same credentials.

enter image description here (Edited the DC text from real domain to example for privacy reasons)

Solution

  • After spending days debugging, I actually ended up filing an issue on the node-ldapjs repository.

    It turns out that they don't support letters like ÆØÅ. The reason my original question doesn't contain these special letters is because I edited the entire DN to ensure confidentiality.