goauthentik / goauthentik/authentik
LDAP bind works without full DN
- Dominant language
- Python
- Stars
- 25.6k
- Forks
- 2k
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 659
Description
### Describe the bug
I was testing an LDAP outpost and forgot the OU that was used so I just bound with `cn=rgingras,dc=example,dc=com` (rgingras is my username) expecting it to fail and to go look up the OU but to my suprise it worked. I saw my user's DN was supposed to be cn=rgingras,ou=users,dc=example,dc=com but I decided to try some other designations to see what would work. All of the following did:
1. cn=rgingras,dc=example,dc=com
2. cn=rgingras,ou=rgingras,dc=example,dc=com
3. cn=rgingras,dc=ldap,dc=example,dc=com
### How to reproduce
1. Create a LDAP provider and application with base dc=example,dc=com
2. Create an outpost bound to that application
3. ldapsearch -H ldaps://outpost.example.com -x -W -b dc=example,dc=com -D cn=username,dc=example,dc=com
### Expected behavior
Binding to the LDAP outpost should require the example DN of the entity attempting the bind.
### Screenshots
_No response_
### Additional context
_No response_
### Deployment Method
Docker
### Version
2026.8.0
### Relevant log output
```shell
```
Contributor guide
Assessment
This issue has not been assessed yet.