Enforce 1:1 baseDN-to-realm and remove cross-realm fallback

Author: anishapant21

docs/MULTI-REALM-ARCHITECTURE.md

@@ -127,6 +127,8 @@ class ConfigurationLoader {
     }
 
     const names = new Set();
+    const baseDns = new Map(); // lowercased baseDn -> realm name
+    let defaultCount = 0;
     for (let i = 0; i < realms.length; i++) {
       const realm = realms[i];
       const prefix = `REALM_CONFIG[${i}]`;
@@ -148,6 +150,21 @@ class ConfigurationLoader {
         throw new Error(`${prefix} (${realm.name}): 'baseDn' is required and must be a string`);
       }
 
+      // Enforce 1:1 baseDN-to-realm mapping
+      const baseDnKey = realm.baseDn.toLowerCase();
+      if (baseDns.has(baseDnKey)) {
+        throw new Error(
+          `${prefix} (${realm.name}): duplicate baseDn '${realm.baseDn}' ` +
+          `(already used by realm '${baseDns.get(baseDnKey)}'). ` +
+          `Each baseDN must map to exactly one realm.`
+        );
+      }
+      baseDns.set(baseDnKey, realm.name);
+
+      if (realm.default === true) {
+        defaultCount++;
+      }
+
       if (!realm.directory || typeof realm.directory !== 'object') {
         throw new Error(`${prefix} (${realm.name}): 'directory' is required and must be an object`);
       }
@@ -175,7 +192,12 @@ class ConfigurationLoader {
       }
 
       logger.info(`Realm '${realm.name}' configured with baseDN '${realm.baseDn}', ` +
-        `directory: ${realm.directory.backend}, auth: [${realm.auth.backends.map(b => b.type).join(', ')}]`);
+        `directory: ${realm.directory.backend}, auth: [${realm.auth.backends.map(b => b.type).join(', ')}]` +
+        (realm.default ? ' (default)' : ''));
+    }
+
+    if (defaultCount > 1) {
+      throw new Error('REALM_CONFIG: only one realm may be marked as "default": true');
     }
   }
 

npm/src/LdapEngine.js

@@ -2,6 +2,7 @@
   {
     "name": "example-corp",
     "baseDn": "dc=example,dc=com",
+    "default": true,
     "directory": {
       "backend": "sql",
       "options": {

npm/test/unit/LdapEngine.realms.test.js

@@ -52,14 +52,11 @@ async function startServer(config) {
     requireAuthForSearch: config.requireAuthForSearch
   };
 
-  // Build global auth provider registry for per-user auth override (Phase 3)
-  // Maps "realm:type" → AuthProvider instance (realm-scoped) and
-  //       "type"       → AuthProvider instance (first-registered fallback)
-  const authProviderRegistry = new Map();
-
   if (config.realms) {
     // Multi-realm mode: build realm objects from config
     logger.info(`Initializing multi-realm mode with ${config.realms.length} realm(s)`);
+    let defaultRealmObj = null;
+
     engineOptions.realms = config.realms.map(realmCfg => {
       // Ensure directory providers receive realm-scoped LDAP base DN so that
       // any provider-side DN construction stays consistent with realmCfg.baseDn.
@@ -72,30 +69,40 @@ async function startServer(config) {
         directoryOptions
       );
 
+      // Build per-realm auth backend type map using explicit type names from config
+      const authBackendTypes = new Map();
       const authProviders = realmCfg.auth.backends.map(backendCfg => {
         const provider = providerFactory.createAuthProvider(backendCfg.type, backendCfg.options || {});
-        // Register with realm-scoped key for accurate per-user auth override
-        const registryKey = `${realmCfg.name}:${backendCfg.type}`;
-        authProviderRegistry.set(registryKey, provider);
-        logger.debug(`Registered auth backend '${registryKey}' in provider registry`);
-        // Also register type-only key as fallback (first realm wins per type)
-        if (!authProviderRegistry.has(backendCfg.type)) {
-          authProviderRegistry.set(backendCfg.type, provider);
-          logger.debug(`Registered fallback auth backend '${backendCfg.type}' (first realm wins)`);
+        const typeKey = backendCfg.type.toLowerCase();
+        if (!authBackendTypes.has(typeKey)) {
+          authBackendTypes.set(typeKey, provider);
         }
+        logger.debug(`Realm '${realmCfg.name}': registered auth backend '${typeKey}'`);
         return provider;
       });
 
       logger.info(`Realm '${realmCfg.name}': baseDN=${realmCfg.baseDn}, ` +
-        `directory=${realmCfg.directory.backend}, auth=[${realmCfg.auth.backends.map(b => b.type).join(', ')}]`);
+        `directory=${realmCfg.directory.backend}, auth=[${realmCfg.auth.backends.map(b => b.type).join(', ')}]` +
+        (realmCfg.default ? ' (default)' : ''));
 
-      return {
+      const realmObj = {
         name: realmCfg.name,
         baseDn: realmCfg.baseDn,
         directoryProvider,
-        authProviders
+        authProviders,
+        authBackendTypes
       };
+
+      if (realmCfg.default) {
+        defaultRealmObj = realmObj;
+      }
+
+      return realmObj;
     });
+
+    if (defaultRealmObj) {
+      engineOptions.defaultRealm = defaultRealmObj;
+    }
   } else {
     // Legacy single-realm mode
     const selectedDirectory = providerFactory.createDirectoryProvider(config.directoryBackend);
@@ -106,18 +113,18 @@ async function startServer(config) {
     engineOptions.authProviders = selectedBackends;
     engineOptions.directoryProvider = selectedDirectory;
 
-    // Register legacy auth providers in the registry
+    // Build auth backend types map for legacy mode
+    const authBackendTypes = new Map();
     for (let idx = 0; idx < config.authBackends.length; idx++) {
-      const backendType = config.authBackends[idx];
-      if (!authProviderRegistry.has(backendType)) {
-        authProviderRegistry.set(backendType, selectedBackends[idx]);
-        logger.debug(`Registered auth backend '${backendType}' in provider registry`);
+      const typeKey = config.authBackends[idx].toLowerCase();
+      if (!authBackendTypes.has(typeKey)) {
+        authBackendTypes.set(typeKey, selectedBackends[idx]);
+        logger.debug(`Registered auth backend '${typeKey}' in provider type map`);
       }
     }
+    engineOptions.authBackendTypes = authBackendTypes;
   }
 
-  engineOptions.authProviderRegistry = authProviderRegistry;
-
   // Create and configure LDAP engine
   const ldapEngine = new LdapEngine(engineOptions);
 

server/config/configurationLoader.js

@@ -34,7 +34,7 @@ function createClient() {
   return ldap.createClient({ url: `ldap://127.0.0.1:${port}` });
 }
 
-// Minimal directory stub – only needs findUser so _authenticateAcrossRealms
+// Minimal directory stub – only needs findUser so _authenticateInRealm
 // can locate the user before delegating to the auth provider.
 const directoryStub = {
   initialize: async () => {},

server/realms.example.json

@@ -183,11 +183,11 @@ describe('ConfigurationLoader._validateRealmConfig', () => {
     }])).toThrow("'auth.backends[0].type' is required");
   });
 
-  test('should accept multiple valid realms with shared baseDN', () => {
+  test('should reject multiple realms with same baseDN', () => {
     const realms = [
       { name: 'realm-a', baseDn: 'dc=shared,dc=com', directory: { backend: 'sql' }, auth: { backends: [{ type: 'sql' }] } },
       { name: 'realm-b', baseDn: 'dc=shared,dc=com', directory: { backend: 'mongodb' }, auth: { backends: [{ type: 'mongodb' }] } }
     ];
-    expect(() => loader._validateRealmConfig(realms)).not.toThrow();
+    expect(() => loader._validateRealmConfig(realms)).toThrow(/duplicate baseDn/);
   });
 });