goauthentik / goauthentik/authentik
LDAP Outpost violates RFC4519 for groupOfNames
- Dominant language
- Python
- Stars
- 25.6k
- Forks
- 2k
- Avg merge
- 1d 1h
- Merged PRs (30d)
- 644
Description
### Describe the bug
The RFC for objectClass "groupOfNames" deems the "member" attribute as "MUST":
https://datatracker.ietf.org/doc/html/rfc4519#section-3.5
Meaning you can't have a groupOfNames entry with no members. Which is a pain, and we've all been complaining that this should have been "MAY" since 2006, and working round it by having dummy users we keep in our groups just so we don't have to keep deleting and recreating them as they empty and fill.
Nevertheless, it is the standard, and there are client libraries out there which will break if you feed them a groupOfNames with no "member" attribute(s).
### How to reproduce
1 - Create a Group with no members in the UI
2 - View it with ldapsearch, it will be searchable, but have no 'member' attribute(s).
### Expected behavior
I would expect the LDAP Outpost not to publish a "groupOfnames" group if it has no members, as per RFC.
### Screenshots
_No response_
### Additional context
_No response_
### Deployment Method
Docker
### Version
2026.2.1
### Relevant log output
```shell
```
Contributor guide
Assessment
This issue has not been assessed yet.