Split LDAP directory into a people-directory type plus a reusable LDAP browser integration

What they did

The author reworked how people directories and LDAP browsing are modelled in the ihub-apps integrations system. They renamed `com.intrafind/ldap-directory` to "People directory (LDAP)", stripped its `browse*` fields and actions, and gave it `type: people-directory` alongside Entra. They then created a new built-in `com.intrafind/ldap-browser` integration that is installable many times, has no type, and reuses a directory's connection (URL, TLS, trusted certs, allowed hosts, sign-in provider, base DN, bind) unless it supplies its own bind account. The browser exposes `browse_search`, `browse_read` and `browse_children` tools, is restricted to signed-in non-delegated users, is never offered over the MCP gateway, and audits every call. A V205 migration moves existing `browse: true` directories into `<dirId>-browser` installations, transfers browse values and action policy, re-grants former `browseGroups` (defaulting to `admins`), rewrites app bindings and group tool grants, and switches people search to bind `type:people-directory`. They also restored dedicated editors for the LDAP directory and built new ones for the LDAP browser and Entra ID directory, backed by a new admin-only `editor-context` route, and added a releases test (#3092) checking every shipped definition has a matching release entry.

How it went

Landed as a stacked PR with a full test pass: 330 suites and 4556 unit tests, plus targeted suites for people-directory, ldap, websearch, integrations, migrations, tool-loading and chat, and a passing Vite client build. New tests cover the V205 migration (20 cases), admin routes, a rewritten browse test, a type-binding access case and the editor components. It boots cleanly on both a fresh install and a simulated upgrade applying V204 and V205 with no error-level logs. One open decision remains: `*` now grants the LDAP browser, so every signed-in user can browse through any app binding it, mitigated only by the disabled-by-default app, delegated-principal refusal, logging and docs.

Worth knowing

The `*` grant widening is unresolved and may need a `grant: "explicit"` definition flag. V205 does not rewrite workflow nodes or agent profiles that name `<dirId>__browse_*` (none ship today). The migration depends on merge order across the stack (#3098 through #3102, then this, then storage V206), and the releases test allow-list only empties once V206 lands. Entra `tenantId`/`clientId` became optional to allow env fallback, which shifts validation to runtime.

Wiring

Definitions live in the integrations config layer: the LDAP directory definition drops `browse*` and gains `type: people-directory` with `compatibility >=5.6.0` and a 1.0.0 release; the new `com.intrafind/ldap-browser` definition is built-in, typeless, multi-install, and references a directory installation by id. At runtime the browser resolves the directory, inherits connection settings and the bind unless it has its own credential, and shares the directory's request queue. Tool ids are `<browserId>__browse_search|browse_read|browse_children`, and a binding without `actions` binds all three. Access is gated by `permissions.integrations` group grants plus a check that the principal is a signed-in non-delegated user and the directory is installed and enabled; the MCP gateway path is blocked and calls are audited. The V205 migration runs after V204 in the stack, rewrites directories, browser installations, app bindings and group tool grants, and removes the redundant required definition binding on fresh installs. Editors call `GET /api/admin/integrations/people-directories/editor-context` (admin only) for presets, limits, sign-in providers without secrets and `AZURE_*` flags. The releases test lives at `server/tests/integration-definition-releases.test.js` and is wired into `test:migrations`.

Try it yourself

In this repo, split LDAP browsing out of the LDAP directory integration. Rename `com.intrafind/ldap-directory` to "People directory (LDAP)", remove its `browse*` fields and actions, and give it `type: people-directory` (shared with Entra). Add a new built-in `com.intrafind/ldap-browser` integration that is installable many times, takes a required `directory` reference plus `baseDn`, `maxResults` (default 50, max 200) and `denyAttributes`, and optionally its own `bindMode`/`bindDn`/`bindPasswordRef`. It should inherit URL, TLS, trusted certs, allowed hosts, sign-in provider, base DN and bind from the directory, share its request queue, and expose `browse_search`, `browse_read` and `browse_children` tools. Restrict browsing to signed-in non-delegated users, never expose it over the MCP gateway, and audit each call with the browser id. Write a V205 migration that creates `<dirId>-browser` for every `browse: true` directory, moves browse values and action policy, grants former `browseGroups` (default `admins`), rewrites app bindings and group tool grants, and switches people search to bind `type:people-directory`. Add dedicated editors for the directory, browser and Entra, backed by an admin-only `editor-context` route, and a test asserting every shipped definition has a release entry.