How scottlai0/ldap_api works
This is a Flask service that accepts Windows-authenticated identity (or the local Windows identity in development), validates a username, retrieves its Active Directory profile over Kerberos-authenticated LDAP, and returns JSON. Its principal stages are identity resolution, input sanitization, directory lookup, and response formatting; /health separately probes LDAP connectivity. README-documented Docker Kerberos/keytab operation is shown as an optional integration. The implementation is concentrated in app.py; detailed route behavior beyond the excerpts is not inferred.
Main entry points: app.py Flask routes · docker-compose.yml Docker runtime
Components 14
HTTP API
- Flask routes
app.py - Identity resolution
app.py - Health response
app.py - User JSON response
app.py
Directory Access
- Username validation
app.py - LDAP profile lookup
app.py - LDAP connection pool
app.py
Identity Integrations
- IIS Windows Auth
- Local Windows identity
- Active Directory
- Kerberos KDC
- Docker runtime
deploy/docker-compose.yml - Kerberos keytab
Other components
- API caller
Connections 16
- API caller → Flask routes: requests
- IIS Windows Auth → Flask routes: sets identity
- Local Windows identity → Identity resolution: provides identity
- Flask routes → Identity resolution: resolves identity
- Identity resolution → Username validation: validates username
- Flask routes → Username validation: validates supplied name
- Username validation → LDAP profile lookup: passes sanitized name
- LDAP profile lookup → LDAP connection pool: opens connection
- LDAP connection pool → Active Directory: searches profile
- Docker runtime → Kerberos keytab: mounts
- Docker runtime → Kerberos KDC: obtains ticket
- Kerberos KDC → Docker runtime: returns ticket
- Docker runtime → LDAP profile lookup: supplies Kerberos credentials
- Flask routes → User JSON response: formats user data
- Flask routes → Health response: formats health status
- Flask routes → LDAP connection pool: probes LDAP