Cannot update password of user from LDAP source (LDAPExtensionError)

### Describe the bug

I added a LDAP source to synchronize an Active directory with password writeback activated (see details on the LDAP source configuration in screenshot below.

I have a password recovery flow which does a "User Write Stage" at the end in order to change the password.

I get an error log: `LDAPExtensionError('extension not in DSA list of supported extensions')`

I am also unable to reset a password user from the administration interface, but it seems to be a different issue because I do not get the LDAPExtensionError but an error `405 Method Not Allowed`

### How to reproduce

First scenario using a recovery flow (LDAP error):
1. Click the "Reset Password" link on identification stage to enter recovery flow
2. go through recovery flow, type new password and validate
3. Actual: get LDAPExtensionError
Note: Same behavior when trying to update from the "User Details" page for an internal user.

Second scenario using admin interface
1. Go to Admin Interface -> Directory -> Users
2. Select a user synced from an LDAP source
3. Click "Set Password"
4. Enter new password and click "Update Password"
5. Actual: Error (405 not allowed)

### Expected behavior

The password is updated and written back in LDAP source for the targeted user

### Screenshots

The LDAP source configuration:

Error in recovery flow during "User Write Stage":

Error when trying to "Set password" from user page in Admin interface:

### Additional context

We followed this doc to create the AD account for sync: https://docs.goauthentik.io/users-sources/sources/directory-sync/active-directory/

### Deployment Method

Docker

### Version

2025.10.2

### Relevant log output

```shell
## LDAP ERROR
server-1 | {"auth_via": "unauthenticated", "domain_url": "auth.dordogne.fr", "event": "Password matched categories", "has": 27, "host": "auth.dordogne.fr", "level": "debug", "logger": "authentik.sources.ldap.password", "must": 3, "pid": 3186043, "request_id": "f10902583bbc4099b682d453cbeb72c1", "schema_name": "public", "timestamp": "2026-02-09T14 4:08:00.779406"}
server-1 | {"auth_via": "unauthenticated", "domain_url": "auth.dordogne.fr", "event": "Password matched categories", "has": 27, "host": "auth.dordogne.fr", "level": "debug", "logger": "authentik.sources.ldap.password", "must": 3, "pid": 3186043, "request_id": "f10902583bbc4099b682d453cbeb72c1", "schema_name": "public", "timestamp": "2026-02-09T14 4:08:01.005909"}
server-1 | {"auth_via": "unauthenticated", "current_stage": "", "domain_url": "auth.dordogne.fr", "event": "f(exec): Current stage", "flow_slug": "mut-recovery-by-sms-flow", "host": "auth.dordogne.fr", "level": "debug", "logger": "authentik.flows.views.executor", "pid": 3186043, "request_id": " "d2b95a3467cf4b13a8a2738ec632986f", "schema_name": "public", "timestamp": "2026-02-09T14:08:02.046851"}
server-1 | {"auth_via": "unauthenticated", "domain_url": "auth.dordogne.fr", "event": "f(exec): Passing GET", "flow_slug": "mut-recovery-by-sms-flow", "host": "auth.dordogne.fr", "level": "debug", "logger": "authentik.flows.views.executor", "pid": 3186043, "request_id": "d2b95a3467cf4b13a8a2738ec632986f", "schema_name": "public", "stage": "", "timestamp": "2026-02-09T14:08:02.057110", "view_class": "authentik.stages.user_write.stage.UserWriteStageView"}
server-1 | {"auth_via": "unauthenticated", "domain_url": "auth.dordogne.fr", "event": "discarding key", "host": "auth.dordogne.fr", "key": "phone", "level": "info", "logger": "authentik.flows.stage", "pid": 3186043, "request_id": "d2b95a3467cf4b13a8a2738ec632986f", "schema_name": "public", "stage": "default-password-change-write", "stage_view": " "authentik.stages.user_write.stage.UserWriteStageView", "timestamp": "2026-02-09T14:08:02.058206"}
server-1 | {"auth_via": "unauthenticated", "domain_url": "auth.dordogne.fr", "event": "discarding key", "host": "auth.dordogne.fr", "key": "password_repeat", "level": "info", "logger": "authentik.flows.stage", "pid": 3186043, "request_id": "d2b95a3467cf4b13a8a2738ec632986f", "schema_name": "public", "stage": "default-password-change-write", "stag ge_view": "authentik.stages.user_write.stage.UserWriteStageView", "timestamp": "2026-02-09T14:08:02.058453"}
server-1 | {"auth_via": "unauthenticated", "domain_url": "auth.dordogne.fr", "event": "Enqueueing message on queue", "host": "auth.dordogne.fr", "level": "debug", "logger": "django_dramatiq_postgres.broker", "message_id": "bfb418b3-16ec-4e6f-a582-cbf153330dca", "pid": 3186043, "queue": "default", "request_id": "d2b95a3467cf4b13a8a2738ec632986f", "schema_name": "public", "timestamp": "2026-02-09T14:08:02.083455"}
worker-1 | {"domain_url": null, "event": "Enqueueing message on queue", "level": "debug", "logger": "django_dramatiq_postgres.broker", "message_id": "54e16ad7-c326-49e9-8dce-0b5c80f27526", "pid": 72, "queue": "default", "schema_name": "public", "timestamp": "2026-02-09T14:08:02.163031"}
worker-1 | {"domain_url": null, "event": "Enqueueing message on queue", "level": "debug", "logger": "django_dramatiq_postgres.broker", "message_id": "da22b752-7ccc-43da-b206-05b6ac397c57", "pid": 72, "queue": "default", "schema_name": "public", "timestamp": "2026-02-09T14:08:02.184822"}
worker-1 | {"domain_url": null, "event": "Enqueueing message on queue", "level": "debug", "logger": "django_dramatiq_postgres.broker", "message_id": "3c14fad7-2ea1-4357-82a6-303a1d833ab7", "pid": 72, "queue": "default", "schema_name": "public", "timestamp": "2026-02-09T14:08:02.208379"}
server-1 | {"auth_via": "unauthenticated", "domain_url": "auth.dordogne.fr", "event": "LDAPExtensionError('extension not in DSA list of supported extensions')", "flow_slug": "mut-recovery-by-sms-flow", "host": "auth.dordogne.fr", "level": "warning", "logger": "authentik.flows.views.executor", "pid": 3186043, "request_id": "d2b95a3467cf4b13a8a2738 8ec632986f", "schema_name": "public", "timestamp": "2026-02-09T14:08:02.813759"}

## SET PASSWORD 405 ERROR
server-1 | {"action": "password_set", "auth_via": "session", "client_ip": "91.232.242.251", "context": {"asn": {"as_org": "ADISTA SAS", "asn": 16347, "network": "91.232.242.0/24"}, "geo": {"city": "", "continent": "EU", "country": "FR", "lat": 48.8582, "long": 2.3387}, "http_request": {"args": {}, "method": "POST", "path": "/api/v3/core/users/2421/set_password/", "request_id": "04b3b682991b44a0830ef89743a00a2b", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0"}}, "domain_url": "auth.dordogne.fr", "event": "Created Event", "host": "auth.dordogne.fr", "level": "info", "logger": "authentik.events.models", "pid": 3186043, "request_id": "04b3b682991b44a0830ef89743a00a2b", "schema_name": "public", "timestamp": "2026-02-09T14:56:27.358515", "user": {"email": "g.clooney_test@mutualisation.fr", "pk": 2421, "username": "g.clooney_test"}}
server-1 | {"auth_via": "session", "domain_url": "auth.dordogne.fr", "event": "Enqueueing message on queue", "host": "auth.dordogne.fr", "level": "debug", "logger": "django_dramatiq_postgres.broker", "message_id": "bfbacb2c-69bd-426a-a161-380fd9bee317", "pid": 3186043, "queue": "default", "request_id": "04b3b682991b44a0830ef89743a00a2b", "schema_name": "public", "timestamp": "2026-02-09T14:56:27.364398"}
server-1 | {"auth_via": "session", "domain_url": "auth.dordogne.fr", "event": "Task enqueued", "host": "auth.dordogne.fr", "level": "info", "logger": "authentik.tasks.middleware", "pid": 3186043, "request_id": "04b3b682991b44a0830ef89743a00a2b", "schema_name": "public", "task_id": "bfbacb2c-69bd-426a-a161-380fd9bee317", "task_name": "authentik.events.tasks.event_trigger_dispatch", "timestamp": "2026-02-09T14:56:27.391048"}
server-1 | {"auth_via": "session", "domain_url": "auth.dordogne.fr", "event": "/api/v3/core/users/2421/set_password/", "host": "auth.dordogne.fr", "level": "info", "logger": "authentik.asgi", "method": "POST", "pid": 3186043, "remote": "91.232.242.251", "request_id": "04b3b682991b44a0830ef89743a00a2b", "runtime": 345, "schema_name": "public", "scheme": "https", "status": 405, "timestamp": "2026-02-09T14:56:27.654010", "user": "adm.le-baut@adm.dordogne.fr", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0"}
```