Connecting

ldap.createClient() accepts an options object that controls how the underlying connection behaves. Getting these right matters more once you're running against a real production directory, not just a local test server.

Basic options

import ldap from "ldapjs";

const client = ldap.createClient({
  url: "ldaps://dc1.example.com:636",
  timeout: 5000,
  connectTimeout: 5000,
  reconnect: true,
});

const ldap = require("ldapjs");

const client = ldap.createClient({
  url: "ldaps://dc1.example.com:636",
  timeout: 5000,
  connectTimeout: 5000,
  reconnect: true,
});

bash

ldapsearch -H ldaps://dc1.example.com:636 \
  -x -b "dc=example,dc=com" -s base "(objectClass=*)"

Option	Purpose
`url`	The server to connect to. Accepts `ldap://` or `ldaps://`, and can be an array of URLs for failover.
`timeout`	Milliseconds to wait for a response to a request before it fails.
`connectTimeout`	Milliseconds to wait for the initial TCP connection.
`reconnect`	Whether ldapjs automatically reconnects after the connection drops.

Connecting to multiple servers

For redundancy, pass an array of URLs — ldapjs will fail over between them:

const client = ldap.createClient({
  url: ["ldaps://dc1.example.com:636", "ldaps://dc2.example.com:636"],
});

TLS options

When connecting with ldaps://, an options object under tlsOptions is passed straight through to Node's tls module, so standard options like ca, rejectUnauthorized, and servername all apply:

const client = ldap.createClient({
  url: "ldaps://dc1.example.com:636",
  tlsOptions: {
    ca: [fs.readFileSync("/etc/ssl/certs/corp-ca.pem")],
  },
});

Warning

Setting rejectUnauthorized: false disables certificate validation entirely. It's a common way to unblock local development against a self-signed test server, but it should never reach production — see Production security with ldapjs.

What's next

With a client configured, the next step is proving identity: Binding.