goauthentik / goauthentik/authentik

LDAP Outpost violates RFC4519 for groupOfNames

Open
#21,363 0 comments 0 reactions 0 assignees View on GitHub
bug bug/confirmed status/reviewing
Dominant language
Python
Stars
25.6k
Forks
2k
Avg merge
1d 1h
Merged PRs (30d)
644

Description

### Describe the bug

The RFC for objectClass "groupOfNames" deems the "member" attribute as "MUST":

https://datatracker.ietf.org/doc/html/rfc4519#section-3.5

Meaning you can't have a groupOfNames entry with no members. Which is a pain, and we've all been complaining that this should have been "MAY" since 2006, and working round it by having dummy users we keep in our groups just so we don't have to keep deleting and recreating them as they empty and fill.

Nevertheless, it is the standard, and there are client libraries out there which will break if you feed them a groupOfNames with no "member" attribute(s).

### How to reproduce

1 - Create a Group with no members in the UI
2 - View it with ldapsearch, it will be searchable, but have no 'member' attribute(s).

### Expected behavior

I would expect the LDAP Outpost not to publish a "groupOfnames" group if it has no members, as per RFC.

### Screenshots

_No response_

### Additional context

_No response_

### Deployment Method

Docker

### Version

2026.2.1

### Relevant log output

```shell

```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.