Doom LDAP Authentication Methods: What Authentication Types Are Supported

Doom exclusively supports NTLM authentication for LDAP connections, handling both standard LDAP (port 389) and secure LDAPS (port 636), while not implementing Simple bind, Kerberos, or other SASL mechanisms.

The 000opp/doom repository provides LDAP integration for authentication workflows, but limits support to Windows Integrated Authentication via NTLM. Understanding these constraints is essential when configuring enterprise directory services with this tool.

Supported Authentication Methods in Doom

NTLM Authentication (Primary Method)

Doom implements NTLM (Windows Integrated Authentication) as its sole LDAP authentication mechanism. According to the source code in src/doom/protocols/ldap.py, the get_ldap_connection function explicitly passes authentication=ldap3.NTLM to the ldap3.Connection constructor on lines 30 and 52.

This implementation requires valid Windows domain credentials (username, password, and domain) to establish the bind. The module also handles special cases such as raw MD4 hash detection (32-character hexadecimal strings), automatically rewriting them to the standard "aad3b435…" format before authentication.

Connection Protocols: LDAP and LDAPS

While authentication is limited to NTLM, Doom supports two transport protocols:

• LDAP (port 389): Standard clear-text LDAP connections
• LDAPS (port 636): Secure LDAP over SSL/TLS

The connection routine attempts NTLM authentication first over standard LDAP. If that fails, it automatically falls back to LDAPS before raising connection errors.

Implementation Details in the Source Code

The LDAP functionality resides in src/doom/protocols/ldap.py. The primary function get_ldap_connection manages the entire authentication workflow:

from doom.protocols.ldap import get_ldap_connection

# Basic NTLM bind over LDAP (389) – falls back to LDAPS (636) if needed

host = "dc.example.local"
domain = "EXAMPLE"
username = "john.doe"
password = "SuperSecret123!"

# Returns (ldap_connection, base_dn)

conn, base_dn = get_ldap_connection(host, username, password, domain)

# Use the connection for subsequent LDAP operations, e.g.:

conn.search(search_base=base_dn,
            search_filter="(objectClass=person)",
            attributes=["cn", "mail"])
entries = conn.entries

Key implementation files include:

• src/doom/protocols/ldap.py: Core LDAP connection routine with NTLM authentication
• src/doom/screens/loading_screen.py: Calls get_ldap_connection during the login flow
• src/doom/modules/enumerate_templates.py: Example usage of LDAP connections passed from the login screen

Authentication Methods Not Supported

Doom explicitly does not implement the following LDAP authentication mechanisms:

• Simple (Anonymous) Bind: No support for unauthenticated directory queries or simple username/password binds without NTLM
• SASL Kerberos: No GSSAPI integration for Kerberos-based single sign-on
• DIGEST-MD5: No support for this SASL mechanism
• Client Certificate Authentication: No support for TLS client certificate-based binds

The connection routine always attempts NTLM binds exclusively, catching LDAPInvalidCredentialsResult errors and re-raising them as generic "Invalid credentials" exceptions without fallback to other mechanisms.

Summary

• Doom supports only NTLM authentication for LDAP connections, as implemented in src/doom/protocols/ldap.py
• Both LDAP (port 389) and LDAPS (port 636) transport protocols are supported with automatic fallback
• The get_ldap_connection function handles credential validation, MD4 hash rewriting, and connection establishment
• No support for Simple bind, Kerberos/GSSAPI, DIGEST-MD5, or anonymous LDAP queries

Frequently Asked Questions

Does Doom support Kerberos authentication for LDAP?

No, Doom does not support Kerberos or GSSAPI authentication. The source code in src/doom/protocols/ldap.py exclusively uses ldap3.NTLM for authentication, with no implementation of SASL mechanisms or Kerberos integration.

What ports does Doom use for LDAP authentication?

Doom attempts connections on port 389 for standard LDAP first, then automatically falls back to port 636 for LDAPS (secure LDAP) if the initial connection fails. This behavior is hardcoded in the connection routine within src/doom/protocols/ldap.py.

Can Doom authenticate using anonymous LDAP binds?

No, Doom requires valid NTLM credentials (username, password, and domain) to establish any LDAP connection. The get_ldap_connection function does not implement Simple bind or anonymous queries, and will raise authentication errors if credentials are missing or invalid.

Where is the LDAP authentication logic implemented in Doom?

The LDAP authentication logic is implemented in src/doom/protocols/ldap.py, specifically within the get_ldap_connection function. This file handles NTLM authentication, connection establishment on ports 389 and 636, MD4 hash rewriting, and error handling for invalid credentials.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}