goauthentik / goauthentik/authentik
LDAP Sync with Microsoft AD broke since 2026.8.0 due to `LDAPAttributeError('invalid attribute type memberOf:1.2.840.113556.1.4.1941:')`
- Dominant language
- Python
- Stars
- 25.6k
- Forks
- 2k
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 659
Description
### Describe the bug
Exactly since upgrade to 2026.8.0, the Federation LDAP Sync with a Microsoft AD entirely broke down.
The only most interesting logs I could find in the worker container is:
```text
..."task_name": "authentik.sources.ldap.tasks.ldap_sync", "timestamp": "2026-08-25T12:36:50.522719"}
{"event": "Failed to process message authentik.sources.ldap.tasks.ldap_sync(UUID('9f24475e-4867-43ae-a88a-1ff9b8446324')) with unhandled exception.", "exception": [{"exc_notes": [], "exc_type": "LDAPAttributeError", "exc_value": "invalid attribute type memberOf:1.2.840.113556.1.4.1941:", ...
```
I am 100% confident that `memberOf:1.2.840.113556.1.4.1941:` did previously work under any prior release. Also, this attribute is also 100% correct with a Microsoft AD and also mentioned in https://docs.goauthentik.io/users-sources/sources/directory-sync/active-directory/.
### How to reproduce
Constant issue. No specific reproduction steps tested.
### Expected behavior
Sync remain working as it did before.
### Screenshots
### Additional context
_No response_
### Deployment Method
Docker
### Version
2026.8.0
### Relevant log output
```shell
{"domain_url": null, "event": "Task started", "level": "info", "logger": "authentik.tasks.middleware", "pid": 21, "schema_name": "public", "task_id": "8df15f3d-f561-429e-bdef-207fc2406f62", "task_name": "authentik.sources.ldap.tasks.ldap_sync", "timestamp": "2026-08-25T12:36:50.522719"}
{"event": "Failed to process message authentik.sources.ldap.tasks.ldap_sync(UUID('9f24475e-4867-43ae-a88a-1ff9b8446324')) with unhandled exception.", "exception": [{"exc_notes": [], "exc_type": "LDAPAttributeError", "exc_value": "invalid attribute type memberOf:1.2.840.113556.1.4.1941:", "exceptions": [], "frames": [{"filename": "/ak-root/.venv/lib/python3.14/site-packages/dramatiq/worker.py", "lineno": 560, "name": "process_message"}, {"filename": "/ak-root/.venv/lib/python3.14/site-packages/dramatiq/actor.py", "lineno": 194, "name": "__call__"}, {"filename": "/authentik/sources/ldap/tasks.py", "lineno": 80, "name": "ldap_sync"}, {"filename": "/authentik/sources/ldap/tasks.py", "lineno": 127, "name": "ldap_sync_paginator"}, {"filename": "/authentik/sources/ldap/sync/base.py", "lineno": 107, "name": "search_paginator"}, {"filename": "/ak-root/.venv/lib/python3.14/site-packages/ldap3/core/connection.py", "lineno": 836, "name": "search"}], "is_cause": false, "is_group": false, "syntax_error": null}], "level": "error", "logger": "dramatiq.worker.WorkerThread", "timestamp": "2026-08-25T12:36:51.113980"}
{"domain_url": null, "event": "Task finished", "exc": "LDAPAttributeError('invalid attribute type memberOf:1.2.840.113556.1.4.1941:')", "level": "info", "logger": "authentik.tasks.middleware", "pid": 21, "schema_name": "public", "task_id": "8df15f3d-f561-429e-bdef-207fc2406f62", "task_name": "authentik.sources.ldap.tasks.ldap_sync", "timestamp":
"2026-08-25T12:36:51.128383"}
```
Contributor guide
Assessment
This issue has not been assessed yet.