goauthentik / goauthentik/authentik

LDAP bind works without full DN

Open
#25,394 5 comments 0 reactions 1 assignee Claimed by @BeryJu View on GitHub
enhancement/confirmed
Dominant language
Python
Stars
25.6k
Forks
2k
Avg merge
1d 2h
Merged PRs (30d)
659

Description

### Describe the bug

I was testing an LDAP outpost and forgot the OU that was used so I just bound with `cn=rgingras,dc=example,dc=com` (rgingras is my username) expecting it to fail and to go look up the OU but to my suprise it worked. I saw my user's DN was supposed to be cn=rgingras,ou=users,dc=example,dc=com but I decided to try some other designations to see what would work. All of the following did:
1. cn=rgingras,dc=example,dc=com
2. cn=rgingras,ou=rgingras,dc=example,dc=com
3. cn=rgingras,dc=ldap,dc=example,dc=com

### How to reproduce

1. Create a LDAP provider and application with base dc=example,dc=com
2. Create an outpost bound to that application
3. ldapsearch -H ldaps://outpost.example.com -x -W -b dc=example,dc=com -D cn=username,dc=example,dc=com

### Expected behavior

Binding to the LDAP outpost should require the example DN of the entity attempting the bind.

### Screenshots

_No response_

### Additional context

_No response_

### Deployment Method

Docker

### Version

2026.8.0

### Relevant log output

```shell

```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.