# Doom LDAP Authentication Methods: What Authentication Types Are Supported

> Discover which LDAP authentication methods Doom supports. Learn that Doom exclusively uses NTLM for LDAP and LDAPS connections, excluding Simple bind and Kerberos.

- Repository: [000pp/doom](https://github.com/000pp/doom)
- Tags: deep-dive
- Published: 2026-02-22

---

**Doom exclusively supports NTLM authentication for LDAP connections, handling both standard LDAP (port 389) and secure LDAPS (port 636), while not implementing Simple bind, Kerberos, or other SASL mechanisms.**

The `000opp/doom` repository provides LDAP integration for authentication workflows, but limits support to Windows Integrated Authentication via NTLM. Understanding these constraints is essential when configuring enterprise directory services with this tool.

## Supported Authentication Methods in Doom

### NTLM Authentication (Primary Method)

Doom implements **NTLM (Windows Integrated Authentication)** as its sole LDAP authentication mechanism. According to the source code in [`src/doom/protocols/ldap.py`](https://github.com/000pp/doom/blob/main/src/doom/protocols/ldap.py), the `get_ldap_connection` function explicitly passes `authentication=ldap3.NTLM` to the `ldap3.Connection` constructor on lines 30 and 52.

This implementation requires valid Windows domain credentials (username, password, and domain) to establish the bind. The module also handles special cases such as raw MD4 hash detection (32-character hexadecimal strings), automatically rewriting them to the standard "aad3b435…" format before authentication.

### Connection Protocols: LDAP and LDAPS

While authentication is limited to NTLM, Doom supports two transport protocols:

- **LDAP** (port 389): Standard clear-text LDAP connections
- **LDAPS** (port 636): Secure LDAP over SSL/TLS

The connection routine attempts NTLM authentication first over standard LDAP. If that fails, it automatically falls back to LDAPS before raising connection errors.

## Implementation Details in the Source Code

The LDAP functionality resides in [`src/doom/protocols/ldap.py`](https://github.com/000pp/doom/blob/main/src/doom/protocols/ldap.py). The primary function `get_ldap_connection` manages the entire authentication workflow:

```python
from doom.protocols.ldap import get_ldap_connection

# Basic NTLM bind over LDAP (389) – falls back to LDAPS (636) if needed

host = "dc.example.local"
domain = "EXAMPLE"
username = "john.doe"
password = "SuperSecret123!"

# Returns (ldap_connection, base_dn)

conn, base_dn = get_ldap_connection(host, username, password, domain)

# Use the connection for subsequent LDAP operations, e.g.:

conn.search(search_base=base_dn,
            search_filter="(objectClass=person)",
            attributes=["cn", "mail"])
entries = conn.entries

```

Key implementation files include:

- [`src/doom/protocols/ldap.py`](https://github.com/000pp/doom/blob/main/src/doom/protocols/ldap.py): Core LDAP connection routine with NTLM authentication
- [`src/doom/screens/loading_screen.py`](https://github.com/000pp/doom/blob/main/src/doom/screens/loading_screen.py): Calls `get_ldap_connection` during the login flow
- [`src/doom/modules/enumerate_templates.py`](https://github.com/000pp/doom/blob/main/src/doom/modules/enumerate_templates.py): Example usage of LDAP connections passed from the login screen

## Authentication Methods Not Supported

Doom explicitly does **not** implement the following LDAP authentication mechanisms:

- **Simple (Anonymous) Bind**: No support for unauthenticated directory queries or simple username/password binds without NTLM
- **SASL Kerberos**: No GSSAPI integration for Kerberos-based single sign-on
- **DIGEST-MD5**: No support for this SASL mechanism
- **Client Certificate Authentication**: No support for TLS client certificate-based binds

The connection routine always attempts NTLM binds exclusively, catching `LDAPInvalidCredentialsResult` errors and re-raising them as generic "Invalid credentials" exceptions without fallback to other mechanisms.

## Summary

- Doom supports **only NTLM authentication** for LDAP connections, as implemented in [`src/doom/protocols/ldap.py`](https://github.com/000pp/doom/blob/main/src/doom/protocols/ldap.py)
- Both **LDAP (port 389)** and **LDAPS (port 636)** transport protocols are supported with automatic fallback
- The `get_ldap_connection` function handles credential validation, MD4 hash rewriting, and connection establishment
- **No support** for Simple bind, Kerberos/GSSAPI, DIGEST-MD5, or anonymous LDAP queries

## Frequently Asked Questions

### Does Doom support Kerberos authentication for LDAP?

No, Doom does not support Kerberos or GSSAPI authentication. The source code in [`src/doom/protocols/ldap.py`](https://github.com/000pp/doom/blob/main/src/doom/protocols/ldap.py) exclusively uses `ldap3.NTLM` for authentication, with no implementation of SASL mechanisms or Kerberos integration.

### What ports does Doom use for LDAP authentication?

Doom attempts connections on port 389 for standard LDAP first, then automatically falls back to port 636 for LDAPS (secure LDAP) if the initial connection fails. This behavior is hardcoded in the connection routine within [`src/doom/protocols/ldap.py`](https://github.com/000pp/doom/blob/main/src/doom/protocols/ldap.py).

### Can Doom authenticate using anonymous LDAP binds?

No, Doom requires valid NTLM credentials (username, password, and domain) to establish any LDAP connection. The `get_ldap_connection` function does not implement Simple bind or anonymous queries, and will raise authentication errors if credentials are missing or invalid.

### Where is the LDAP authentication logic implemented in Doom?

The LDAP authentication logic is implemented in [`src/doom/protocols/ldap.py`](https://github.com/000pp/doom/blob/main/src/doom/protocols/ldap.py), specifically within the `get_ldap_connection` function. This file handles NTLM authentication, connection establishment on ports 389 and 636, MD4 hash rewriting, and error handling for invalid credentials.