goauthentik / goauthentik/authentik
Wrongly allocated Port 9000 causes segfault in LDAP outpost
- Dominant language
- Python
- Stars
- 25.6k
- Forks
- 2k
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 651
Description
**Describe the bug**
When starting authentik on a machine with an already allocated port 9000 (that's on me, no question!), you get an error like
```
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x28 pc=0x9c6a5c]
goroutine 1 [running]:
goauthentik.io/internal/outpost/ak.NewAPIController({{0xc00003c06f, 0x5}, {0x0, 0x0}, 0x0, {0xc00003c077, 0xc}, {0x0, 0x0}, {0x0, ...}, ...}, ...)
goauthentik.io/internal/outpost/ak/api.go:95 +0x63c
goauthentik.io/internal/outpost/ak/entrypoint.OutpostMain({0xc4c646?, 0x0?}, 0xc8be38)
goauthentik.io/internal/outpost/ak/entrypoint/entrypoint.go:33 +0x14d
main.init.func1(0xc000124800?, {0xc3eb36?, 0x7?, 0xc3c153?})
goauthentik.io/cmd/ldap/main.go:28 +0x26
github.com/spf13/cobra.(*Command).execute(0x121e220, {0xc0000340a0, 0x0, 0x0})
github.com/spf13/cobra@v1.9.1/command.go:1015 +0xaaa
github.com/spf13/cobra.(*Command).ExecuteC(0x121e220)
github.com/spf13/cobra@v1.9.1/command.go:1148 +0x46f
github.com/spf13/cobra.(*Command).Execute(...)
github.com/spf13/cobra@v1.9.1/command.go:1071
main.main()
goauthentik.io/cmd/ldap/main.go:38 +0x48
authentik-ldap.service: Main process exited, code=exited, status=2/INVALIDARGUMENT
```
from the LDAP service.
Reason is that if the response is empty (which happened here), the retry-loop in https://github.com/goauthentik/authentik/blob/57e12cef068d655e3d55c7befd401c7e36f024b3/internal/outpost/ak/api.go#L95 completes, but gives `nil` as result.
**To Reproduce**
* Start a service on port 9000 on the machine authentik itself runs on
* Start the LDAP outpost
**Expected behavior**
* A failed port bind shouldn't just be a "note" in the authentik service, it should fail loud.
* Properly handle the error in the outpost code (check if the format is unexpected and fail loudly)
**Screenshots**
n/a
**Logs**
see above
**Version and Deployment (please complete the following information):**
- authentik version: 2025.8.1, 2025.8.2
- Deployment: unsupported (nix)
**Additional context**
Add any other context about the problem here.
Contributor guide
Research direction
Start at internal/outpost/ak/api.go:95, then trace how internal/outpost/ak/entrypoint/entrypoint.go and cmd/ldap/main.go handle the API result. Reproduce the LDAP outpost startup with port 9000 occupied and inspect the empty response path. Done means the outpost reports the bind failure clearly instead of reaching a nil-pointer panic.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- authentication, backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 45/100