goauthentik / goauthentik/authentik
Kerberos sync job stops working after a while
- Dominant language
- Python
- Stars
- 25.6k
- Forks
- 2k
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 651
Description
### Describe the bug
I have a Kerberos source connected to an MIT Kerberos server.
After a couple of hours, its sync job starts failing with the following message: `KAdmin error: Communication failure with server (code: 43787528)`
The same also happens if kadmind is restarted.
This can be temporarily resolved by restarting the authentik-worker container.
### How to reproduce
1. Set up a Kerberos source with sync enabled
2. Restart kadmind, or wait a couple of hours (~5h in my latest test)
3. Run the Kerberos sync job
### Expected behavior
The sync job should continue to work.
### Screenshots
_No response_
### Additional context
When using a password or keytab for Authentik's service principal, kadmind logs the following messages at each sync attempt:
```
Sep 10 00:13:26 ldap1 kadmind[23397]: Authentication attempt failed: 10.xxx.xxx.xxx, RPC authentication flavor 6
Sep 10 00:13:26 ldap1 kadmind[23397]: check_rpcsec_auth: failed inquire_context, stat=786432
Sep 10 00:13:26 ldap1 kadmind[23397]: Authentication attempt failed: 10.xxx.xxx.xxx, GSS-API error strings are:
Sep 10 00:13:26 ldap1 kadmind[23397]: The referenced context has expired
Sep 10 00:13:26 ldap1 kadmind[23397]: Success
Sep 10 00:13:26 ldap1 kadmind[23397]: GSS-API error strings complete.
```
kadmind does not log anything if an external ticket cache (maintained by `k5start`) is used, or when the problem is triggered by a restart of kadmind itself.
### Deployment Method
Docker
### Version
2026.8.0
### Relevant log output
```shell
Sep 09 22:00:21 authentik systemd-authentik-worker[128478]: {"channel": "authentik.tasks.default.enqueue", "domain_url": null, "event": "Finished receiving postgres notifies on channel", "level": "debug", "logger": "django_dramatiq_postgres.broker", "notifies": 0, "pid": 18, "schema_name": "public", "timestamp": "2026-09-09T20:00:21.717990"}
Sep 09 22:00:21 authentik systemd-authentik-worker[128478]: {"domain_url": null, "event": "Fetching for pending messages", "level": "debug", "logger": "django_dramatiq_postgres.broker", "pid": 18, "queue": "default", "schema_name": "public", "timestamp": "2026-09-09T20:00:21.718174"}
Sep 09 22:00:21 authentik systemd-authentik-worker[128478]: {"domain_url": null, "event": "Finished fetching pending messages in queue", "level": "debug", "logger": "django_dramatiq_postgres.broker", "pending": 0, "pid": 18, "queue": "default", "schema_name": "public", "timestamp": "2026-09-09T20:00:21.719969"}
Sep 09 22:00:21 authentik systemd-authentik-worker[128478]: {"domain_url": null, "event": "Backlogging tasks waiting for dependencies", "level": "debug", "logger": "django_dramatiq_postgres.broker", "pid": 18, "queue": "default", "schema_name": "public", "timestamp": "2026-09-09T20:00:21.720055"}
Sep 09 22:00:21 authentik systemd-authentik-worker[128478]: {"domain_url": null, "event": "Enqueueing message on queue", "level": "debug", "logger": "django_dramatiq_postgres.broker", "message_id": "40575b12-f2e1-4cac-bf83-15a04b6ca224", "pid": 18, "queue": "default", "schema_name": "public", "timestamp": "2026-09-09T20:00:21.725359"}
Sep 09 22:00:21 authentik systemd-authentik-worker[128478]: {"domain_url": null, "event": "Task enqueued", "level": "info", "logger": "authentik.tasks.middleware", "pid": 18, "schema_name": "public", "task_id": "40575b12-f2e1-4cac-bf83-15a04b6ca224", "task_name": "authentik.enterprise.tasks.enterprise_update_usage", "timestamp": "2026-09-09T20:00:21.729186"}
Sep 09 22:00:21 authentik systemd-authentik-worker[128478]: {"domain_url": null, "event": "Sent 1 scheduled tasks", "level": "info", "logger": "django_dramatiq_postgres.scheduler", "pid": 18, "schema_name": "public", "timestamp": "2026-09-09T20:00:21.733901"}
Sep 09 22:00:21 authentik systemd-authentik-worker[128478]: {"domain_url": null, "event": "Polling for message notifications", "level": "debug", "logger": "django_dramatiq_postgres.broker", "pid": 18, "queue": "default", "schema_name": "public", "timestamp": "2026-09-09T20:00:21.734330"}
Sep 09 22:00:21 authentik systemd-authentik-worker[128478]: {"channel": "authentik.tasks.default.enqueue", "domain_url": null, "event": "Finished receiving postgres notifies on channel", "level": "debug", "logger": "django_dramatiq_postgres.broker", "notifies": 1, "pid": 18, "schema_name": "public", "timestamp": "2026-09-09T20:00:21.734655"}
Sep 09 22:00:21 authentik systemd-authentik-worker[128478]: {"event": "Pushing message '40575b12-f2e1-4cac-bf83-15a04b6ca224' onto work queue.", "level": "debug", "logger": "dramatiq.worker.ConsumerThread(default)", "timestamp": "2026-09-09T20:00:21.738155"}
Sep 09 22:00:21 authentik systemd-authentik-worker[128478]: {"domain_url": null, "event": "Polling for message notifications", "level": "debug", "logger": "django_dramatiq_postgres.broker", "pid": 18, "queue": "default", "schema_name": "public", "timestamp": "2026-09-09T20:00:21.738234"}
Sep 09 22:00:21 authentik systemd-authentik-worker[128478]: {"event": "Received message authentik.enterprise.tasks.enterprise_update_usage() with id '40575b12-f2e1-4cac-bf83-15a04b6ca224'.", "level": "debug", "logger": "dramatiq.worker.WorkerThread", "timestamp": "2026-09-09T20:00:21.738440"}
Sep 09 22:00:21 authentik systemd-authentik-worker[128478]: {"domain_url": null, "event": "Task started", "level": "info", "logger": "authentik.tasks.middleware", "pid": 18, "schema_name": "public", "task_id": "40575b12-f2e1-4cac-bf83-15a04b6ca224", "task_name": "authentik.enterprise.tasks.enterprise_update_usage", "timestamp": "2026-09-09T20:00:21.753771"}
Sep 09 22:00:21 authentik systemd-authentik-worker[128478]: {"event": "Received args=() kwargs={}.", "level": "debug", "logger": "authentik.enterprise.tasks.enterprise_update_usage", "timestamp": "2026-09-09T20:00:21.756441"}
Sep 09 22:00:21 authentik systemd-authentik-worker[128478]: {"event": "Completed after 1.97ms.", "level": "debug", "logger": "authentik.enterprise.tasks.enterprise_update_usage", "timestamp": "2026-09-09T20:00:21.758510"}
Sep 09 22:00:21 authentik systemd-authentik-worker[128478]: {"domain_url": null, "event": "Task finished", "exc": null, "level": "info", "logger": "authentik.tasks.middleware", "pid": 18, "schema_name": "public", "task_id": "40575b12-f2e1-4cac-bf83-15a04b6ca224", "task_name": "authentik.enterprise.tasks.enterprise_update_usage", "timestamp": "2026-09-09T20:00:21.761030"}
Sep 09 22:00:21 authentik systemd-authentik-worker[128478]: {"event": "Acknowledging message '40575b12-f2e1-4cac-bf83-15a04b6ca224'.", "level": "debug", "logger": "dramatiq.worker.ConsumerThread(default)", "timestamp": "2026-09-09T20:00:21.765915"}
Sep 09 22:00:21 authentik systemd-authentik-worker[128478]: {"domain_url": null, "event": "Post-processing message", "level": "debug", "logger": "django_dramatiq_postgres.broker", "message": "40575b12-f2e1-4cac-bf83-15a04b6ca224", "pid": 18, "schema_name": "public", "state": "done", "timestamp": "2026-09-09T20:00:21.766001"}
```
Contributor guide
Research direction
Start by reproducing the failure with a Kerberos source sync after restarting kadmind or waiting several hours, then trace the Kerberos source sync job and its worker lifecycle. Compare password, keytab, and external ticket-cache behavior; done means sync continues successfully after ticket-context expiry and kadmind restarts without restarting the worker container.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- authentication, backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100