goauthentik / goauthentik/authentik

Wrongly allocated Port 9000 causes segfault in LDAP outpost

Open
#16,850 1 comment 1 reaction 0 assignees View on GitHub
bug bug/confirmed
Dominant language
Python
Stars
25.6k
Forks
2k
Avg merge
1d 2h
Merged PRs (30d)
651

Description

**Describe the bug**
When starting authentik on a machine with an already allocated port 9000 (that's on me, no question!), you get an error like

```
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x28 pc=0x9c6a5c]
goroutine 1 [running]:
goauthentik.io/internal/outpost/ak.NewAPIController({{0xc00003c06f, 0x5}, {0x0, 0x0}, 0x0, {0xc00003c077, 0xc}, {0x0, 0x0}, {0x0, ...}, ...}, ...)
goauthentik.io/internal/outpost/ak/api.go:95 +0x63c
goauthentik.io/internal/outpost/ak/entrypoint.OutpostMain({0xc4c646?, 0x0?}, 0xc8be38)
goauthentik.io/internal/outpost/ak/entrypoint/entrypoint.go:33 +0x14d
main.init.func1(0xc000124800?, {0xc3eb36?, 0x7?, 0xc3c153?})
goauthentik.io/cmd/ldap/main.go:28 +0x26
github.com/spf13/cobra.(*Command).execute(0x121e220, {0xc0000340a0, 0x0, 0x0})
github.com/spf13/cobra@v1.9.1/command.go:1015 +0xaaa
github.com/spf13/cobra.(*Command).ExecuteC(0x121e220)
github.com/spf13/cobra@v1.9.1/command.go:1148 +0x46f
github.com/spf13/cobra.(*Command).Execute(...)
github.com/spf13/cobra@v1.9.1/command.go:1071
main.main()
goauthentik.io/cmd/ldap/main.go:38 +0x48
authentik-ldap.service: Main process exited, code=exited, status=2/INVALIDARGUMENT
```

from the LDAP service.

Reason is that if the response is empty (which happened here), the retry-loop in https://github.com/goauthentik/authentik/blob/57e12cef068d655e3d55c7befd401c7e36f024b3/internal/outpost/ak/api.go#L95 completes, but gives `nil` as result.

**To Reproduce**

* Start a service on port 9000 on the machine authentik itself runs on
* Start the LDAP outpost

**Expected behavior**

* A failed port bind shouldn't just be a "note" in the authentik service, it should fail loud.
* Properly handle the error in the outpost code (check if the format is unexpected and fail loudly)

**Screenshots**
n/a

**Logs**
see above

**Version and Deployment (please complete the following information):**

- authentik version: 2025.8.1, 2025.8.2
- Deployment: unsupported (nix)

**Additional context**
Add any other context about the problem here.

Contributor guide

Open the contributing guide

Research direction

Start at internal/outpost/ak/api.go:95, then trace how internal/outpost/ak/entrypoint/entrypoint.go and cmd/ldap/main.go handle the API result. Reproduce the LDAP outpost startup with port 9000 occupied and inspect the empty response path. Done means the outpost reports the bind failure clearly instead of reaching a nil-pointer panic.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
authentication, backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.