goauthentik / goauthentik/authentik

openldap: password is mandatory in simple bind

Open
#18,137 5 comments 1 reaction 0 assignees View on GitHub
bug bug/confirmed
Dominant language
Python
Stars
25.6k
Forks
2k
Avg merge
1d 2h
Merged PRs (30d)
659

Description

**Describe the bug**
When creating an LDAP Source to sync accounts from an `openldap` server, the connection never works and shows

```
Connectivity

openldap: password is mandatory in simple bind
Global status: password is mandatory in simple bind
```

The connection is without TLS or SSL:

Image

The Bind CN and passwort are set and the exact same credentials are successfully used in other applications to acces the openldap server:

Image

I've tried re-setting the passwort and also tied different bind CNs with no luck.

I have also tried different browsers, incognito sessions and also deleted my caches.

**To Reproduce**
Steps to reproduce the behavior:

1. Add LDAP source
2. Enter credentials to access openldap server
3. Save settings
4. See error

**Expected behavior**
To connect to the openldap server and establish the connection.

**Logs**

The logs also show the attempt and they show that openldap indeed accepts the connection but later drops it due to timeout:

```
020-authentik-worker | {"domain_url": null, "event": "Task enqueued", "level": "info", "logger": "authentik.tasks.middleware", "pid": 88, "schema_name": "public", "task_id": "b5aa2a75-6044-4bca-9bb6-ebfe2e7a57b4", "task_name": "authentik.sources.ldap.tasks.ldap_connectivity_check", "timestamp": "2025-11-13T21:02:53.876783"}
020-authentik-server | {"auth_via": "session", "domain_url": "authentik.XXX.de", "event": "Task enqueued", "host": "authentik.XXX.de", "level": "info", "logger": "authentik.tasks.middleware", "pid": 65, "request_id": "00b265b51d8242f48aacd5cfafd94a4c", "schema_name": "public", "task_id": "83ae8150-9ce4-485c-93d4-ec662b6a3e60", "task_name": "authentik.events.tasks.event_trigger_dispatch", "timestamp": "2025-11-13T21:02:53.881542"}
openldap | 6916477d conn=1704 fd=12 ACCEPT from IP=172.29.0.4:55395 (IP=0.0.0.0:389)
020-authentik-worker | {"event": "Failed to process message authentik.sources.ldap.tasks.ldap_sync(UUID('07171606-e929-44a7-83bd-563aa8b96fe0')) with unhandled exception.", "exception": [{"exc_notes": [], "exc_type": "LDAPPasswordIsMandatoryError", "exc_value": "password is mandatory in simple bind", "exceptions": [], "frames": [{"filename": "/ak-root/.venv/lib/python3.13/site-packages/dramatiq/worker.py", "lineno": 487, "name": "process_message"}, {"filename": "/ak-root/.venv/lib/python3.13/site-packages/dramatiq/actor.py", "lineno": 185, "name": "__call__"}, {"filename": "/authentik/sources/ldap/tasks.py", "lineno": 67, "name": "ldap_sync"}, {"filename": "/authentik/sources/ldap/tasks.py", "lineno": 110, "name": "ldap_sync_paginator"}, {"filename": "/authentik/sources/ldap/sync/users.py", "lineno": 33, "name": "__init__"}, {"filename": "/authentik/sources/ldap/sync/base.py", "lineno": 29, "name": "__init__"}, {"filename": "/authentik/sources/ldap/models.py", "lineno": 274, "name": "connection"}, {"filename": "/ak-root/.venv/lib/python3.13/site-packages/ldap3/core/connection.py", "lineno": 604, "name": "bind"}, {"filename": "/ak-root/.venv/lib/python3.13/site-packages/ldap3/operation/bind.py", "lineno": 59, "name": "bind_operation"}], "is_cause": false, "is_group": false, "syntax_error": null}], "level": "error", "logger": "dramatiq.worker.WorkerThread", "timestamp": "2025-11-13T21:02:53.893179"}
[...]
openldap | 6916477e conn=1704 fd=12 closed (connection lost)
```

**Version and Deployment (please complete the following information):**

- authentik version: 2025.10.1
- Deployment: docker-compose (traefik)
- openldap: osixia/openldap:1.2.2

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.