[xuelei9300]

Problem

Logging in via LDAP fails with a "session inactive" error after the user has logged out once. The login request itself succeeds (returns a token), but subsequent authenticated requests (e.g. /api/me) return 401 session inactive, so the user ends up logged out immediately — the frontend shows both a "login success" and a "session inactive" prompt.

Root Cause

The LDAP login handler loginLdap does not call device.EnsureActiveOnLogin, unlike the password login handler loginHash. When a user logs out, their device session is marked inactive. Logging in again via LDAP never reactivates that session, so the token is bound to an inactive session and the auth middleware (HandleSession → device.Handle) rejects follow-up requests with errs.SessionInactive (401).

This is the same class of issue that was fixed for the SSO login path.

Fix

Add the missing device.EnsureActiveOnLogin call in loginLdap and return device_key in the response, matching the password login flow:

• Compute the device key from user.ID and Client-Id (identical to loginHash).
• Call device.EnsureActiveOnLogin(user.ID, key, userAgent, clientIP) before generating the token, handling errs.TooManyDevices with 403 like the password path.
• Return device_key alongside token.

Verification

• go build ./server/handles/ passes
• gofmt clean