# `Macaw.Auth.Native.Source.Ldap.Config`
[🔗](https://github.com/dcoai/macaw_auth/blob/v0.4.1/lib/macaw/auth/native/source/ldap/config.ex#L1)

An LDAP source's configuration, validated with its defaults filled
(ported from exio's and macaw's `LdapSource`), so a bad one is refused
naming the source and the key: `sources[nas].host: is required`.

- **Connection:** `host` (required), `port` (636), `ssl` (true),
  `starttls` (false), `allow_plaintext` (false), `verify_peer` (true),
  `cacertfile` (the system's CAs when absent), `timeout_ms` (5000).
  `allow_plaintext: false` refuses a source with neither `ssl` nor
  `starttls`, because its bind would send passwords in the clear;
  setting it true is an explicit, visible decision.
- **Finding the user**, exactly one of: `user_dn_template` containing
  `{username}` (a direct bind: `uid={username},cn=users,dc=example,dc=test`),
  or `search: %{base_dn, filter, bind_dn, bind_password}` (filter default
  `(uid={username})`; an anonymous search only with
  `allow_anonymous_search: true`).
- **Attributes:** `id_attr` (`entryUUID`; the DN when absent),
  `username_attr` (`uid`), `email_attr` (`mail`), `display_name_attr`
  (`cn`).
- **Groups:** `groups: %{base_dn, member_attr}` with `member_attr` one of
  `member` (groupOfNames, the default), `uniqueMember`, or `memberUid`
  (posixGroup, matched by the username), or `groups: %{from: :member_of}`.
- **Access:** `required_group` (a CN or DN), `role_mapping` (a map of
  group to a role or a list of roles; the user gets every mapped role of
  every group they are in) and `default_role` (a role, or a list, for a
  user no mapping matched). With neither a match nor a default, the user
  is refused (`:no_role`).

`bind_password` is a literal, `{:env, "VAR"}` or `{:file, path}`,
resolved here; no error message contains it, and the struct's inspection
hides it.

# `parse`

```elixir
@spec parse(map(), keyword()) ::
  {:ok, Macaw.Auth.Native.Source.Ldap.t()} | {:error, String.t()}
```

`{:ok, %Ldap{}}` or `{:error, "sources[<name>].<key>: …"}`.

---

*Consult [api-reference.md](api-reference.md) for complete listing*