An LDAP source's configuration, validated with its defaults filled (ported from exio's and macaw's LdapSource), so a bad one is refused naming the source and the key: sources[nas].host: is required.

• Connection: host (required), port (636), ssl (true), starttls (false), allow_plaintext (false), verify_peer (true), cacertfile (the system's CAs when absent), timeout_ms (5000). allow_plaintext: false refuses a source with neither ssl nor starttls, because its bind would send passwords in the clear; setting it true is an explicit, visible decision.
• Finding the user, exactly one of: user_dn_template containing {username} (a direct bind: uid={username},cn=users,dc=example,dc=test), or search: %{base_dn, filter, bind_dn, bind_password} (filter default (uid={username}); an anonymous search only with allow_anonymous_search: true).
• Attributes: id_attr (entryUUID; the DN when absent), username_attr (uid), email_attr (mail), display_name_attr (cn).
• Groups: groups: %{base_dn, member_attr} with member_attr one of member (groupOfNames, the default), uniqueMember, or memberUid (posixGroup, matched by the username), or groups: %{from: :member_of}.
• Access: required_group (a CN or DN), role_mapping (a map of group to a role or a list of roles; the user gets every mapped role of every group they are in) and default_role (a role, or a list, for a user no mapping matched). With neither a match nor a default, the user is refused (:no_role).

bind_password is a literal, {:env, "VAR"} or {:file, path}, resolved here; no error message contains it, and the struct's inspection hides it.