goauthentik / goauthentik/authentik

LDAP Outpost: Unable to change password via LDAP

Open
#2,112 4 comments 1 reaction 0 assignees View on GitHub
enhancement enhancement/confirmed
Dominant language
Python
Stars
25.6k
Forks
2k
Avg merge
1d 1h
Merged PRs (30d)
644

Description

**Describe the bug**
I'm not sure if this is a bug or a feature, but I'm unable to change password via LDAP when used with Authelia.

**To Reproduce**
Steps to reproduce the behavior:
1. Deploy LDAP outpost
2. Deploy Authelia with LDAP
3. Try to change password via Authelia
4. Have it fail.

**Expected behavior**
I would have expected it to let me change my password.

**Logs**
Authelia:
```
time="2022-01-19T23:06:25Z" level=error msg="unable to update password. Cause: LDAP Result Code 50 \"Insufficient Access Rights\": Insufficient Access Rights" method=POST path=/api/reset-password remote_ip="2001:67c:1104:" stack="github.com/authelia/authelia/v4/internal/middlewares/authelia_context.go:60 (*AutheliaCtx).Error\ngithub.com/authelia/authelia/v4/internal/handlers/handler_reset_password_step2.go:38 ResetPasswordPost\ngithub.com/authelia/authelia/v4/internal/middlewares/authelia_context.go:51 AutheliaMiddleware.func1.1\ngithub.com/fasthttp/router@v1.4.4/router.go:414 (*Router).Handler\ngithub.com/authelia/authelia/v4/internal/middlewares/log_request.go:14 LogRequestMiddleware.func1\ngithub.com/valyala/fasthttp@v1.31.0/server.go:2278 (*Server).serveConn\ngithub.com/valyala/fasthttp@v1.31.0/workerpool.go:223 (*workerPool).workerFunc\ngithub.com/valyala/fasthttp@v1.31.0/workerpool.go:195 (*workerPool).getCh.func1\nruntime/asm_arm64.s:1133
```

LDAP outpost:
```
{"bindDN":"cn=akadmin,dc=ldap,dc=skylab,dc=fi","client":"10.0.105.15","component":"ak-stage-identification","event":"Got challenge","flow":"default-authentication-flow","level":"debug","requestId":"ed9e111b-20df-492b-a59a-00bdd865ef9b","timestamp":"2022-01-19T23:14:48Z","type":"native"}
{"bindDN":"cn=akadmin,dc=ldap,dc=skylab,dc=fi","client":"10.0.105.15","component":"ak-stage-password","event":"Got response","flow":"default-authentication-flow","level":"debug","requestId":"ed9e111b-20df-492b-a59a-00bdd865ef9b","timestamp":"2022-01-19T23:14:49Z","type":"native"}
{"bindDN":"cn=akadmin,dc=ldap,dc=skylab,dc=fi","client":"10.0.105.15","component":"ak-stage-password","event":"Got challenge","flow":"default-authentication-flow","level":"debug","requestId":"ed9e111b-20df-492b-a59a-00bdd865ef9b","timestamp":"2022-01-19T23:14:49Z","type":"native"}
{"bindDN":"cn=akadmin,dc=ldap,dc=skylab,dc=fi","client":"10.0.105.15","component":"xak-flow-redirect","event":"Got response","flow":"default-authentication-flow","level":"debug","requestId":"ed9e111b-20df-492b-a59a-00bdd865ef9b","timestamp":"2022-01-19T23:14:50Z","type":"redirect"}
{"bindDN":"cn=akadmin,dc=ldap,dc=skylab,dc=fi","client":"10.0.105.15","event":"User has access","flow":"default-authentication-flow","level":"debug","requestId":"ed9e111b-20df-492b-a59a-00bdd865ef9b","timestamp":"2022-01-19T23:14:50Z"}
{"bindDN":"cn=akadmin,dc=ldap,dc=skylab,dc=fi","client":"10.0.105.15","event":"User has access","level":"info","requestId":"ed9e111b-20df-492b-a59a-00bdd865ef9b","timestamp":"2022-01-19T23:14:50Z"}
{"bindDN":"cn=akadmin,dc=ldap,dc=skylab,dc=fi","client":"10.0.105.15","event":"Allowed access to search","group":"authentik Admins","level":"info","requestId":"ed9e111b-20df-492b-a59a-00bdd865ef9b","timestamp":"2022-01-19T23:14:50Z"}
{"bindDN":"cn=akadmin,dc=ldap,dc=skylab,dc=fi","client":"10.0.105.15","event":"Bind request","level":"info","requestId":"ed9e111b-20df-492b-a59a-00bdd865ef9b","timestamp":"2022-01-19T23:14:50Z","took-ms":2248}
{"baseDN":"ou=users,dc=ldap,dc=skylab,dc=fi","bindDN":"cn=akadmin,dc=ldap,dc=skylab,dc=fi","client":"10.0.105.15","event":"Search request","filter":"(\u0026(cn=sm))","level":"info","requestId":"18eb95d3-3ebf-4178-9008-2452bc24f000","scope":"Whole Subtree","timestamp":"2022-01-19T23:14:50Z","took-ms":0}
```

**Version and Deployment (please complete the following information):**
- authentik version: 2021.12.5
- Deployment: Helm

**Additional context**

Authelia's config can be found here: https://github.com/samip5/k8s-cluster/blob/62ff8515c4866f2ce56b916238729d969afdefc7/cluster/apps/security/authelia_fi/helm-release.yaml#L112-L123

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.