# scottlai0/ldap_api architecture

> Architecture diagram of the GitHub repository scottlai0/ldap_api, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-29). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/scottlai0/ldap_api
- Repository: https://github.com/scottlai0/ldap_api

## Overview

This is a Flask service that accepts Windows-authenticated identity (or the local Windows identity in development), validates a username, retrieves its Active Directory profile over Kerberos-authenticated LDAP, and returns JSON. Its principal stages are identity resolution, input sanitization, directory lookup, and response formatting; `/health` separately probes LDAP connectivity. README-documented Docker Kerberos/keytab operation is shown as an optional integration. The implementation is concentrated in `app.py`; detailed route behavior beyond the excerpts is not inferred.

Main entry points: [`app.py`](https://github.com/scottlai0/ldap_api/blob/main/app.py) (Flask routes), [`deploy/docker-compose.yml`](https://github.com/scottlai0/ldap_api/blob/main/deploy/docker-compose.yml) (Docker runtime)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_api["HTTP API"]
  node_flask_routes["Flask routes<br/>[app.py]"]
  node_identity_resolution["Identity resolution<br/>[app.py]"]
  node_health_response["Health response<br/>[app.py]"]
  node_user_response["User JSON response<br/>[app.py]"]
end

subgraph group_directory["Directory Access"]
  node_username_sanitization["Username validation<br/>[app.py]"]
  node_ldap_lookup["LDAP profile lookup<br/>[app.py]"]
  node_connection_pool["LDAP connection pool<br/>[app.py]"]
end

subgraph group_integrations["Identity Integrations"]
  node_iis["IIS Windows Auth"]
  node_local_identity["Local Windows identity"]
  node_ad[("Active Directory")]
  node_kdc["Kerberos KDC"]
  node_docker_runtime["Docker runtime<br/>[docker-compose.yml]"]
  node_keytab["Kerberos keytab"]
end

node_caller(("API caller"))

node_caller -->|"requests"| node_flask_routes
node_iis -.->|"sets identity"| node_flask_routes
node_local_identity -.->|"provides identity"| node_identity_resolution
node_flask_routes -->|"resolves identity"| node_identity_resolution
node_identity_resolution -->|"validates username"| node_username_sanitization
node_flask_routes -->|"validates supplied name"| node_username_sanitization
node_username_sanitization -->|"passes sanitized name"| node_ldap_lookup
node_ldap_lookup -->|"opens connection"| node_connection_pool
node_connection_pool -->|"searches profile"| node_ad
node_docker_runtime -.->|"mounts"| node_keytab
node_docker_runtime -.->|"obtains ticket"| node_kdc
node_kdc -.->|"returns ticket"| node_docker_runtime
node_docker_runtime -.->|"supplies Kerberos credentials"| node_ldap_lookup
node_flask_routes -->|"formats user data"| node_user_response
node_flask_routes -->|"formats health status"| node_health_response
node_flask_routes -->|"probes LDAP"| node_connection_pool

click node_flask_routes "https://github.com/scottlai0/ldap_api/blob/main/app.py"
click node_identity_resolution "https://github.com/scottlai0/ldap_api/blob/main/app.py"
click node_username_sanitization "https://github.com/scottlai0/ldap_api/blob/main/app.py"
click node_ldap_lookup "https://github.com/scottlai0/ldap_api/blob/main/app.py"
click node_connection_pool "https://github.com/scottlai0/ldap_api/blob/main/app.py"
click node_docker_runtime "https://github.com/scottlai0/ldap_api/blob/main/deploy/docker-compose.yml"
click node_health_response "https://github.com/scottlai0/ldap_api/blob/main/app.py"
click node_user_response "https://github.com/scottlai0/ldap_api/blob/main/app.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_flask_routes,node_identity_resolution,node_health_response,node_user_response toneBlue
class node_username_sanitization,node_ldap_lookup,node_connection_pool toneAmber
class node_iis,node_local_identity,node_ad,node_kdc,node_docker_runtime,node_keytab,node_caller toneMint
```

## Components

### HTTP API

- [Flask routes](https://github.com/scottlai0/ldap_api/blob/main/app.py): `app.py`
- [Identity resolution](https://github.com/scottlai0/ldap_api/blob/main/app.py): `app.py`
- [Health response](https://github.com/scottlai0/ldap_api/blob/main/app.py): `app.py`
- [User JSON response](https://github.com/scottlai0/ldap_api/blob/main/app.py): `app.py`

### Directory Access

- [Username validation](https://github.com/scottlai0/ldap_api/blob/main/app.py): `app.py`
- [LDAP profile lookup](https://github.com/scottlai0/ldap_api/blob/main/app.py): `app.py`
- [LDAP connection pool](https://github.com/scottlai0/ldap_api/blob/main/app.py): `app.py`

### Identity Integrations

- **IIS Windows Auth**
- **Local Windows identity**
- **Active Directory**
- **Kerberos KDC**
- [Docker runtime](https://github.com/scottlai0/ldap_api/blob/main/deploy/docker-compose.yml): `deploy/docker-compose.yml`
- **Kerberos keytab**

### Other components

- **API caller**

## Connections

- API caller → Flask routes: requests
- IIS Windows Auth → Flask routes: sets identity
- Local Windows identity → Identity resolution: provides identity
- Flask routes → Identity resolution: resolves identity
- Identity resolution → Username validation: validates username
- Flask routes → Username validation: validates supplied name
- Username validation → LDAP profile lookup: passes sanitized name
- LDAP profile lookup → LDAP connection pool: opens connection
- LDAP connection pool → Active Directory: searches profile
- Docker runtime → Kerberos keytab: mounts
- Docker runtime → Kerberos KDC: obtains ticket
- Kerberos KDC → Docker runtime: returns ticket
- Docker runtime → LDAP profile lookup: supplies Kerberos credentials
- Flask routes → User JSON response: formats user data
- Flask routes → Health response: formats health status
- Flask routes → LDAP connection pool: probes LDAP