Feature Request: Allow excluding specific users from LDAP authentication #67

Problem Statement

When using the valkey-ldap module alongside local ACL service accounts, the module attempts to authenticate all users against LDAP, including service accounts that are intentionally defined only in the local ACL with passwords stored in Kubernetes secrets.

This generates continuous LDAP authentication failures in logs and creates unnecessary load on LDAP servers.

Current Behavior

Environment:

• Valkey deployment: 1 master + 2 replicas
• Deployment method: Official Valkey Helm chart
• Module: valkey-ldap

Configuration:

ldap.search_attribute "cn"
ldap.search_scope "sub"
ldap.search_dn_attribute "distinguishedName"
ldap.search_filter "objectClass=user"

ACL service accounts (local-only, not in LDAP):

• sa_replica
• sa_haproxy_watcher
• sa_sentinel_monitor
• sa_metrics

Observed logs:

LDAP authentication failure: search filter '(&(objectClass=user)(cn=sa_haproxy_watcher))' returned no entries
LDAP authentication failure: search filter '(&(objectClass=user)(cn=sa_replica))' returned no entries

These errors repeat continuously as service accounts authenticate for replication, monitoring, and health checks.

Impact

1. LDAP server load: Unnecessary search queries for users that will never exist in LDAP
2. Log pollution: Continuous authentication failure messages
3. Operational confusion: Makes it harder to identify genuine authentication issues

Requested Feature

Add configuration option(s) to exclude specific users from LDAP authentication. Proposed approaches:

Option 1: Exclude list by pattern

ldap.exclude_users "sa_*,service_*,system_*"

When a user matching an excluded pattern attempts authentication, skip LDAP entirely and use only local ACL credentials.

Option 2: Whitelist approach

ldap.include_users "*"
ldap.exclude_users "sa_*"

More flexible filtering with both include and exclude patterns.

Expected Behavior

When a user attempts authentication:

1. Check if username matches exclude pattern (e.g., sa_, service_)
2. If match: authenticate ONLY against local ACL, never query LDAP
3. If no match: use current LDAP authentication flow
4. LDAP server is never queried for excluded users

Use Case Justification

This is a common pattern in enterprise deployments:

• Human users: Authenticate via LDAP (centralized, SSO integration)
• Service accounts: Local ACL only (automation, replication, monitoring)

Separating these concerns reduces LDAP dependency.

Would be happy to contribute to implementation if there's interest in this feature.

Environment Details

• Valkey version: 9.0.1 bundle
• valkey-ldap version: 1.0
• Deployment: Kubernetes with official Helm chart
• LDAP server: Active Directory