ldapauth

type Options struct {
	// LDAP scheme (ldap or ldaps).
	Scheme string
	// Verify indicates whether TLS verification should be performed.
	Verify bool
	// Timeout sets the request timeout for the LDAP connection.
	Timeout time.Duration
	// Debug can be set to enable debug output, for example with
	// adauth.NewDebugFunc(...).
	Debug func(string, ...any)
	// SimpleBind indicates that SimpleBind authentication should be used
	// instead of NTLM, Kerberos or mTLS. For this, a cleartext password is
	// required.
	SimpleBind bool
	// TLSConfig for LDAPS or LDAP+StartTLS. InsecureSkipVerify is ignored and
	// set according to Options.Verify. MaxVersion will be changed to 1.2 unless
	// Options.DisableChannelBinding is set.
	TLSConfig *tls.Config
	// DisableChannelBinding omits the TLS certificate hash in Kerberos and NTLM
	// authentication.
	DisableChannelBinding bool
	// StartTLS indicates that a TLS connection should be established even for
	// non-LDAPS connections before authenticating. For client-certificate
	// authentication on regular LDAP connections, StartTLS will be used even if
	// this option is disabled.
	StartTLS bool
	// DialOptions can be used to customize the connection. However
	// ldap.DialWithTLSConfig will be ignored, because TLS setup is handled
	// internally.
	DialOptions []ldap.DialOpt
	// PKINITOptions can be used to modify the behavior of PKINIT when it is
	// used.
	PKINITOptions []pkinit.Option
}