Golang communicate with LDAP

I'm trying to connect and authenticate a user to ldap with golang.

I'm using the go-ldap-client with the following example code:

package main

import (
    "log"
    "github.com/jtblin/go-ldap-client"
)

func main() {
    client := &ldap.LDAPClient{
        Base:         "dc=example,dc=com",
        Host:         "ldap.example.com",
        Port:         389,
        UseSSL:       false,
        BindDN:       "uid=readonlysuer,ou=People,dc=example,dc=com",
        BindPassword: "readonlypassword",
        UserFilter:   "(uid=%s)",
        GroupFilter: "(memberUid=%s)",
        Attributes:   []string{"givenName", "sn", "mail", "uid"},
    }
    # It is the responsibility of the caller to close the connection
    defer client.Close()

    ok, user, err := client.Authenticate("username", "password")
    if err != nil {
        log.Fatalf("Error authenticating user %s: %+v", "username", err)
    }
    if !ok {
        log.Fatalf("Authenticating failed for user %s", "username")
    }
    log.Printf("User: %+v", user)

    groups, err := client.GetGroupsOfUser("username")
    if err != nil {
        log.Fatalf("Error getting groups for user %s: %+v", "username", err)
    }
    log.Printf("Groups: %+v", groups) 
}

The dependency to gopkg.in/ldap.v2 is installed.

The problem is that I'm getting the following error:

2016/01/15 17:34:55 Error authenticating user username: LDAP Result Code 2 "Protocol Error": ldap: cannot StartTLS (unsupported extended operation)
exit status 1

Any hint about this error?

Ok, so let's try authentication using github.com/go-ldap/ldap. First you need to create a an *ldap.Conn. I suggest using TLS, if your LDAP server supports it:

// TLS, for testing purposes disable certificate verification, check https://golang.org/pkg/crypto/tls/#Config for further information.
tlsConfig := &tls.Config{InsecureSkipVerify: true}
l, err := ldap.DialTLS("tcp", "ldap.example.com:636", tlsConfig)

// No TLS, not recommended
l, err := ldap.Dial("tcp", "ldap.example.com:389")

Now you should have an active connection to your LDAP server. Using this connection you have to execute a bind:

err := l.Bind("user@test.com", "password")
if err != nil {
    // error in ldap bind
    log.Println(err)
}
// successful bind

Another possible solution to use go-guardian LDAP strategy

A working example based on Online LDAP Test Server

package main

import (
	"fmt"
	"github.com/shaj13/go-guardian/auth/strategies/ldap"
	"net/http"
)

func main() {
	cfg := ldap.Config{
		BaseDN:       "dc=example,dc=com",
		BindDN:       "cn=read-only-admin,dc=example,dc=com",
		Port:         "389",
		Host:         "ldap.forumsys.com",
		BindPassword: "password",
		Filter:       "(uid=%s)",
	}

	r, _ := http.NewRequest("GET", "/", nil)
	r.SetBasicAuth("tesla", "password")

	user, err := ldap.New(&cfg).Authenticate(r.Context(), r)
	fmt.Println(user, err)
}

The issue is that by default the "SkipTLS" flag is not set in the aforementioned LDAP client. You need to explicitly set the parameter to false:

client := &ldap.LDAPClient{
        Base:         "dc=example,dc=com",
        Host:         "ldap.example.com",
        Port:         389,
        UseSSL:       false,
        BindDN:       "uid=readonlysuer,ou=People,dc=example,dc=com",
        BindPassword: "readonlypassword",
        UserFilter:   "(uid=%s)",
        GroupFilter:  "(memberUid=%s)",
        SkipTLS:      true,
        Attributes:   []string{"givenName", "sn", "mail", "uid"},
    }

I set the SkipTLS to true and it worked.
Hope this helps!

In one line:

conn, err := ldap.DialTLS("tcp", ldapServer, &tls.Config{InsecureSkipVerify: true})