goauthentik / goauthentik/authentik

Password change in LDAP using user's own credentials

Open
#2,589 0 comments 3 reactions 0 assignees View on GitHub
enhancement enhancement/confirmed
Dominant language
Python
Stars
25.6k
Forks
2k
Avg merge
1d 1h
Merged PRs (30d)
644

Description

**Is your feature request related to a problem? Please describe.**
I would like to provide Authentik with read-only credentials to my LDAP instance (for security) ***and*** allow users to change their LDAP passwords in Authentik.

**Describe the solution you'd like**
If LDAP user specified in `bind_dn` do not has permissions to change user password, whole procedure errors out. However, in my setup, users have possibility to change their own password, using their own credentials. It would require in Authentik to bind to LDAP using users's credentials temporarily for just a password change. All other LDAP related operations would be done by `bind_dn` user.

**Describe alternatives you've considered**
Configuring Authentik with credentials of user that has read-write access to LDAP instance. I would liek to avoid that to follow least privilege principle.

**Additional context**
I do know that this might be obscure use case but it would be beneficial for me to have such possibility. I've look at the source code but I'm not proficient in Django to know what exactly needs to be done.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.