Icon of Sin - Authentik LLDAP configuration
# troubleshootingi
Icon of Sin
08/08/2025, 2:15 PMAuthentik LLDAP configuration
Icon of Sin
08/08/2025, 2:15 PMHello
n
nitnelave
08/08/2025, 2:15 PMCan you share the latest LDAP query? Just the first line is enough
i
Icon of Sin
08/08/2025, 2:16 PMDEBUG ┝━ 🐛 [debug]: | msg: LdapMsg { msgid: 50, op: BindRequest(LdapBindRequest { dn: "uid=lldap-authentik-bearer,ou=people,dc=example,dc=com", cred: LdapBindCred::Simple }), ctrl: [] }
Icon of Sin
08/08/2025, 2:17 PMlldap-authentik-bearer is just a user with lldap password and readonly groups
n
nitnelave
08/08/2025, 2:17 PMThat's the login, we need the search request
i
Icon of Sin
08/08/2025, 2:17 PMokay my bad
Icon of Sin
08/08/2025, 2:17 PMfirst line is enough ?
Icon of Sin
08/08/2025, 2:18 PM Copy code
DEBUG ┝━ :bug: [debug]: | msg: LdapMsg { msgid: 51, op: SearchRequest(LdapSearchRequest { base: "", scope: Base, aliases: Always, sizelimit: 0, timelimit: 0, typesonly: false, filter: Present("objectClass"), attrs: ["altServer", "namingContexts", "supportedControl", "supportedExtension", "supportedFeatures", "supportedCapabilities", "supportedLdapVersion", "supportedSASLMechanisms", "vendorName", "vendorVersion", "subschemaSubentry", "*", "+", "+"] }), ctrl: [] }n
nitnelave
08/08/2025, 2:19 PMOkay, that's the schema request 🙂
There should be a query with base DN ou=groups,dc=...
nitnelave
08/08/2025, 2:20 PMI expect it to have "member" in the requested attributes
i
Icon of Sin
08/08/2025, 2:21 PMi dumped it into a text editor
Icon of Sin
08/08/2025, 2:22 PMthere is no member
Icon of Sin
08/08/2025, 2:22 PMi am trying to fnid the entry you wanted
n
nitnelave
08/08/2025, 2:22 PMAnd then in the list of returned groups, there should be the users
i
Icon of Sin
08/08/2025, 2:23 PM Copy code
DEBUG ┝━ :bug: [debug]: | response: SearchResultEntry(LdapSearchResultEntry { dn: "", attributes: [LdapPartialAttribute { atype: "objectClass", vals: ["top"] }, LdapPartialAttribute { atype: "vendorName", vals: ["LLDAP"] }, LdapPartialAttribute { atype: "vendorVersion", vals: ["lldap_0.6.1"] }, LdapPartialAttribute { atype: "supportedLDAPVersion", vals: ["3"] }, LdapPartialAttribute { atype: "supportedExtension", vals: ["1.3.6.1.4.1.4203.1.11.1"] }, LdapPartialAttribute { atype: "supportedControl", vals: [] }, LdapPartialAttribute { atype: "supportedFeatures", vals: ["1.3.6.1.4.1.4203.1.5.1"] }, LdapPartialAttribute { atype: "defaultNamingContext", vals: ["dc=example,dc=com"] }, LdapPartialAttribute { atype: "namingContexts", vals: ["dc=example,dc=com"] }, LdapPartialAttribute { atype: "isGlobalCatalogReady", vals: ["false"] }] })Icon of Sin
08/08/2025, 2:23 PMsorry, this is probably not what you are lookng for
n
nitnelave
08/08/2025, 2:24 PMThat's the root dse response
i
Icon of Sin
08/08/2025, 2:24 PMis it possible the sync is not syncing everything somehow ?
n
nitnelave
08/08/2025, 2:24 PMMaybe authentik caches stuff and doesn't request again?
i
Icon of Sin
08/08/2025, 2:25 PMyeah possibly
Icon of Sin
08/08/2025, 2:26 PMi believe so since the requests are getting shorter and shorter lol
Icon of Sin
08/08/2025, 2:26 PMany keywords I should look out for ?
n
nitnelave
08/08/2025, 2:26 PMSearch request with a non empty base
i
Icon of Sin
08/08/2025, 2:27 PMIcon of Sin
08/08/2025, 2:27 PMdont know if it means something but
Icon of Sin
08/08/2025, 2:28 PMgot it, I dont have any so far
Icon of Sin
08/08/2025, 2:28 PMI will check the older logs maybe there is smth there
n
nitnelave
08/08/2025, 2:28 PMMaybe reset authentik?
i
Icon of Sin
08/08/2025, 2:28 PMActually I deleted the older connectoin I had and remade this one
Icon of Sin
08/08/2025, 2:28 PMso this one is new technically
Icon of Sin
08/08/2025, 2:32 PMI looked through 12 search requests, all of them have base : ""
Icon of Sin
08/08/2025, 2:32 PMis thats how its supposed to be
n
nitnelave
08/08/2025, 3:01 PMThat's the root dse request
nitnelave
08/08/2025, 3:01 PMThe "index.html" if you want, describes the server
i
Icon of Sin
08/08/2025, 3:05 PMI dumped the whole log and those are the only search requests that are
n
nitnelave
08/08/2025, 3:20 PMWell then, authentik is not requesting anything again
nitnelave
08/08/2025, 3:20 PMMaybe because the users/groups already exist? I don't know how it works
j
Jakob
08/08/2025, 5:46 PMI don't use authentik myself, so I cannot help. But since I don't see it mentioned before, did you check the example config?
https://github.com/lldap/lldap/blob/main/example_configs/authentik.md
i
Icon of Sin
08/09/2025, 11:50 AMyes, the example config has a part that is missing that is probably causing the issue
r
realspinelle
09/20/2025, 9:16 PMyou found ?
cause i got it syncing but not the groups members
realspinelle
09/20/2025, 9:16 PM@Icon of Sin
realspinelle
09/20/2025, 9:21 PMcause doing everything same as the exemple works for me but im missing this
https://cdn.discordapp.com/attachments/1403381132820615270/1419070905035788288/image.png?ex=68d06c44&is=68cf1ac4&hm=d4e90743402b64dfc4082581fa2e7f79b35c699f8a401d8e6c37eaa18505272e&
realspinelle
09/20/2025, 9:21 PMcause of that my groups are empty
realspinelle
09/20/2025, 9:22 PMfilled it with random shit cause its required but
realspinelle
09/20/2025, 9:23 PMsearched a bit and it should be uid or dn i guess ? but im not sure i tried
realspinelle
09/20/2025, 9:27 PMtried distinguishedName too idk
realspinelle
09/20/2025, 9:30 PMk i found to add to the exemple config x)
Lookup using a user attribute turned off
and
User membership attribute to distinguishedName
n
nitnelave
09/20/2025, 9:39 PMThat seems weird, I would expect it to be "memberOf" or "member"
r
realspinelle
09/20/2025, 9:48 PMIdk it works not gonna complain 😂
realspinelle
09/20/2025, 9:52 PMMemberof might have worked
realspinelle
09/20/2025, 9:53 PMBut in the documentation of authentik it says if group is member put distinguishedName so i tried
n
nitnelave
09/20/2025, 9:57 PMOh, I see
nitnelave
09/20/2025, 9:57 PMMore LDAP inconsistent naming and confusing explanations
nitnelave
09/20/2025, 9:58 PMYeah, I see what they mean in their docs
nitnelave
09/20/2025, 9:58 PMDN is correct
i
Icon of Sin
09/22/2025, 12:48 PMcan confirm it works
Icon of Sin
09/22/2025, 12:48 PMmerci
n
nitnelave
09/22/2025, 12:49 PMCan either of you send a PR to update the docs?
i
Icon of Sin
09/22/2025, 12:49 PMI dont have a github account unfortunately
n
nitnelave
09/22/2025, 12:50 PM@realspinelle can you take care of this?
r
realspinelle
09/22/2025, 12:58 PMSure
realspinelle
09/24/2025, 12:14 PM@nitnelave done