goauthentik / goauthentik/authentik

LDAP Sync with Microsoft AD broke since 2026.8.0 due to `LDAPAttributeError('invalid attribute type memberOf:1.2.840.113556.1.4.1941:')`

Open
#25,469 2 comments 0 reactions 1 assignee Claimed by @gergosimonyi View on GitHub
bug bug/confirmed
Dominant language
Python
Stars
25.6k
Forks
2k
Avg merge
1d 2h
Merged PRs (30d)
659

Description

### Describe the bug

Exactly since upgrade to 2026.8.0, the Federation LDAP Sync with a Microsoft AD entirely broke down.

The only most interesting logs I could find in the worker container is:

```text
..."task_name": "authentik.sources.ldap.tasks.ldap_sync", "timestamp": "2026-08-25T12:36:50.522719"}
{"event": "Failed to process message authentik.sources.ldap.tasks.ldap_sync(UUID('9f24475e-4867-43ae-a88a-1ff9b8446324')) with unhandled exception.", "exception": [{"exc_notes": [], "exc_type": "LDAPAttributeError", "exc_value": "invalid attribute type memberOf:1.2.840.113556.1.4.1941:", ...
```

I am 100% confident that `memberOf:1.2.840.113556.1.4.1941:` did previously work under any prior release. Also, this attribute is also 100% correct with a Microsoft AD and also mentioned in https://docs.goauthentik.io/users-sources/sources/directory-sync/active-directory/.

### How to reproduce

Constant issue. No specific reproduction steps tested.

### Expected behavior

Sync remain working as it did before.

### Screenshots

Image

### Additional context

_No response_

### Deployment Method

Docker

### Version

2026.8.0

### Relevant log output

```shell
{"domain_url": null, "event": "Task started", "level": "info", "logger": "authentik.tasks.middleware", "pid": 21, "schema_name": "public", "task_id": "8df15f3d-f561-429e-bdef-207fc2406f62", "task_name": "authentik.sources.ldap.tasks.ldap_sync", "timestamp": "2026-08-25T12:36:50.522719"}
{"event": "Failed to process message authentik.sources.ldap.tasks.ldap_sync(UUID('9f24475e-4867-43ae-a88a-1ff9b8446324')) with unhandled exception.", "exception": [{"exc_notes": [], "exc_type": "LDAPAttributeError", "exc_value": "invalid attribute type memberOf:1.2.840.113556.1.4.1941:", "exceptions": [], "frames": [{"filename": "/ak-root/.venv/lib/python3.14/site-packages/dramatiq/worker.py", "lineno": 560, "name": "process_message"}, {"filename": "/ak-root/.venv/lib/python3.14/site-packages/dramatiq/actor.py", "lineno": 194, "name": "__call__"}, {"filename": "/authentik/sources/ldap/tasks.py", "lineno": 80, "name": "ldap_sync"}, {"filename": "/authentik/sources/ldap/tasks.py", "lineno": 127, "name": "ldap_sync_paginator"}, {"filename": "/authentik/sources/ldap/sync/base.py", "lineno": 107, "name": "search_paginator"}, {"filename": "/ak-root/.venv/lib/python3.14/site-packages/ldap3/core/connection.py", "lineno": 836, "name": "search"}], "is_cause": false, "is_group": false, "syntax_error": null}], "level": "error", "logger": "dramatiq.worker.WorkerThread", "timestamp": "2026-08-25T12:36:51.113980"}
{"domain_url": null, "event": "Task finished", "exc": "LDAPAttributeError('invalid attribute type memberOf:1.2.840.113556.1.4.1941:')", "level": "info", "logger": "authentik.tasks.middleware", "pid": 21, "schema_name": "public", "task_id": "8df15f3d-f561-429e-bdef-207fc2406f62", "task_name": "authentik.sources.ldap.tasks.ldap_sync", "timestamp":
"2026-08-25T12:36:51.128383"}
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.