goauthentik / goauthentik/authentik
Nested user attributes not exposed as valid LDAP attributes in LDAP Outpost
- Dominant language
- Python
- Stars
- 25.6k
- Forks
- 2k
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 651
Description
**Describe the bug**
When exposing custom attributes via the LDAP outpost, nested attributes are not returned as individual LDAP attributes. Instead, they appear in a serialized map format that does not seem to comply with LDAP.
**To Reproduce**
Steps to reproduce the behavior:
1. Configure a user in Authentik with a custom attribute containing nested values, e.g. settings.locale = en.
2. Query the user via the LDAP outpost using ldapsearch.
3. Inspect the LDAP response.
See that the attribute is returned as a serialized map string rather than as a proper multi-valued LDAP attribute.
**Expected behavior**
I would expect the LDAP outpost to flatten or map the nested attribute into standard LDAP attributes, for example:
```
settingsLocale: en
```
or
```
settings.locale: en
```
instead of:
```
settings: map[locale:en]
```
**Version and Deployment (please complete the following information):**
- authentik version: 2025.8.3
- Deployment: Docker
**Additional context**
Add any other context about the problem here.
Contributor guide
Research direction
Start by reproducing the LDAP outpost response with ldapsearch using a user custom attribute containing a nested value such as settings.locale. Inspect how the LDAP outpost represents that attribute, then verify that nested values are exposed as valid individual or multi-valued LDAP attributes rather than a serialized map string.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- authentication, backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100