Adding LDAP login

.env.example

@@ -26,6 +26,21 @@ COOKIE_NAME=access_token
 # Set true when serving over HTTPS.
 COOKIE_SECURE=false
 
+# --- LDAP (optional; direct-bind) ---
+# When enabled, the login page and /api/auth/ldap-login accept a directory
+# username + password. On first login a local profile is provisioned using the
+# username and the default role (mark one in the Roles admin UI).
+LDAP_ENABLED=false
+LDAP_HOST=localhost
+LDAP_PORT=389
+LDAP_USE_SSL=false
+# "{username}" is substituted with the submitted username to form the bind DN.
+LDAP_BIND_DN_TEMPLATE="uid={username},ou=people,dc=example,dc=com"
+# Provisioned users get the email "<username>@<LDAP_EMAIL_DOMAIN>".
+LDAP_EMAIL_DOMAIN=example.com
+# LDAP attribute read for the provisioned user's display name.
+LDAP_FULL_NAME_ATTR=cn
+
 # --- CORS (JSON list) ---
 CORS_ORIGINS=["*"]