{"record":{"id":"16e4b3778a4124a4","repo":"projectdiscovery/nuclei","slug":"unsupported-ldap-url-schema-v","errorCode":null,"errorMessage":"unsupported ldap url schema %v","messagePattern":"unsupported ldap url schema (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/js/libs/ldap/ldap.go","lineNumber":142,"sourceCode":"\t\t\t\tconn, err = dialers.Fastdialer.Dial(dialCtx, \"udp\", net.JoinHostPort(host, port))\n\t\t\tcase \"ldap\":\n\t\t\t\tif port == \"\" {\n\t\t\t\t\tport = ldap.DefaultLdapPort\n\t\t\t\t}\n\t\t\t\tconn, err = dialers.Fastdialer.Dial(dialCtx, \"tcp\", net.JoinHostPort(host, port))\n\t\t\tcase \"ldaps\":\n\t\t\t\tif port == \"\" {\n\t\t\t\t\tport = ldap.DefaultLdapsPort\n\t\t\t\t}\n\t\t\t\tserverName := host\n\t\t\t\tif c.cfg.ServerName != \"\" {\n\t\t\t\t\tserverName = c.cfg.ServerName\n\t\t\t\t}\n\t\t\t\tconn, err = dialers.Fastdialer.DialTLSWithConfig(dialCtx, \"tcp\", net.JoinHostPort(host, port),\n\t\t\t\t\t&tls.Config{InsecureSkipVerify: true, MinVersion: tls.VersionTLS10, ServerName: serverName})\n\t\t\t}\n\t\tdefault:\n\t\t\terr = fmt.Errorf(\"unsupported ldap url schema %v\", u.Scheme)\n\t\t}\n\t\tc.nj.HandleError(err, \"failed to connect to ldap server\")\n\t}\n\tc.conn = ldap.NewConn(conn, u.Scheme == \"ldaps\")\n\tif u.Scheme != \"ldaps\" && c.cfg.Upgrade {\n\t\tserverName := u.Hostname()\n\t\tif c.cfg.ServerName != \"\" {\n\t\t\tserverName = c.cfg.ServerName\n\t\t}\n\t\tif err := c.conn.StartTLS(&tls.Config{InsecureSkipVerify: true, ServerName: serverName}); err != nil {\n\t\t\tc.nj.HandleError(err, \"failed to upgrade to tls\")\n\t\t}\n\t} else {\n\t\tc.conn.Start()\n\t}\n\n\treturn utils.LinkConstructor(call, runtime, c)\n}","sourceCodeStart":124,"sourceCodeEnd":160,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/js/libs/ldap/ldap.go#L124-L160","documentation":"Thrown by the ldap.Client constructor when the URL scheme is not one of ldap, ldaps, ldapi or cldap. An empty scheme defaults to ldap, so this error only fires for a genuinely different scheme token after url.Parse lowercases it.","triggerScenarios":"new ldap.Client('gc://dc01:3268', 'ACME') (Global Catalog), 'http://...', 'ldap3://...'; also copy-pasted Windows LDP strings with unusual prefixes. Note 'GC://' parses to scheme 'gc' and hits this branch.","commonSituations":"Using the AD Global Catalog port URI gc:// out of habit from PowerShell/AD tooling; typos in the scheme; forgetting that ldapi is the Unix-socket scheme and inventing variants like 'ldaps+unix://'.","solutions":["Use one of the four supported prefixes: ldap://, ldaps:// (TLS), ldapi:// (unix socket), cldap:// (UDP, deprecated CLDAP)","For Global Catalog, use ldap://host:3268 or ldaps://host:3269 — the TDS/LDAP wire protocol is the same","Drop the scheme entirely to default to plain ldap://"],"exampleFix":"// before\nconst c = new ldap.Client('gc://dc01.acme.local:3268', 'ACME'); // unsupported schema gc\n\n// after\nconst c = new ldap.Client('ldap://dc01.acme.local:3268', 'ACME');","handlingStrategy":"validation","validationCode":"const ALLOWED = ['ldap', 'ldaps', 'ldapi', 'cldap'];\nconst scheme = ldapUrl.split(':')[0].toLowerCase();\nconst url = (scheme === '' || ALLOWED.includes(scheme)) ? ldapUrl : 'ldap://' + ldapUrl.replace(/^[a-zA-Z0-9+.-]+:\\/\\//, '');\nconst client = new ldap.Client(url, realm);","typeGuard":"const isSupportedLdapUrl = (u) => {\n  const s = u.split(':')[0].toLowerCase();\n  return s === '' || ['ldap','ldaps','ldapi','cldap'].includes(s);\n};","tryCatchPattern":null,"preventionTips":["Stick to the four documented prefixes: ldap:// ldaps:// ldapi:// cldap://","Map gc:// to ldap:// on port 3268/3269","Default to ldap:// when in doubt (an empty scheme is auto-defaulted)"],"tags":["ldap","url","validation","javascript","config"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}