goauthentik / goauthentik/authentik

Kerberos sync job stops working after a while

Open
#26,060 1 comment 0 reactions 0 assignees View on GitHub
bug bug/confirmed triage
Dominant language
Python
Stars
25.6k
Forks
2k
Avg merge
1d 2h
Merged PRs (30d)
651

Description

### Describe the bug

I have a Kerberos source connected to an MIT Kerberos server.
After a couple of hours, its sync job starts failing with the following message: `KAdmin error: Communication failure with server (code: 43787528)`
The same also happens if kadmind is restarted.
This can be temporarily resolved by restarting the authentik-worker container.

### How to reproduce

1. Set up a Kerberos source with sync enabled
2. Restart kadmind, or wait a couple of hours (~5h in my latest test)
3. Run the Kerberos sync job

### Expected behavior

The sync job should continue to work.

### Screenshots

_No response_

### Additional context

When using a password or keytab for Authentik's service principal, kadmind logs the following messages at each sync attempt:
```
Sep 10 00:13:26 ldap1 kadmind[23397]: Authentication attempt failed: 10.xxx.xxx.xxx, RPC authentication flavor 6
Sep 10 00:13:26 ldap1 kadmind[23397]: check_rpcsec_auth: failed inquire_context, stat=786432
Sep 10 00:13:26 ldap1 kadmind[23397]: Authentication attempt failed: 10.xxx.xxx.xxx, GSS-API error strings are:
Sep 10 00:13:26 ldap1 kadmind[23397]: The referenced context has expired
Sep 10 00:13:26 ldap1 kadmind[23397]: Success
Sep 10 00:13:26 ldap1 kadmind[23397]: GSS-API error strings complete.
```

kadmind does not log anything if an external ticket cache (maintained by `k5start`) is used, or when the problem is triggered by a restart of kadmind itself.

### Deployment Method

Docker

### Version

2026.8.0

### Relevant log output

```shell
Sep 09 22:00:21 authentik systemd-authentik-worker[128478]: {"channel": "authentik.tasks.default.enqueue", "domain_url": null, "event": "Finished receiving postgres notifies on channel", "level": "debug", "logger": "django_dramatiq_postgres.broker", "notifies": 0, "pid": 18, "schema_name": "public", "timestamp": "2026-09-09T20:00:21.717990"}
Sep 09 22:00:21 authentik systemd-authentik-worker[128478]: {"domain_url": null, "event": "Fetching for pending messages", "level": "debug", "logger": "django_dramatiq_postgres.broker", "pid": 18, "queue": "default", "schema_name": "public", "timestamp": "2026-09-09T20:00:21.718174"}
Sep 09 22:00:21 authentik systemd-authentik-worker[128478]: {"domain_url": null, "event": "Finished fetching pending messages in queue", "level": "debug", "logger": "django_dramatiq_postgres.broker", "pending": 0, "pid": 18, "queue": "default", "schema_name": "public", "timestamp": "2026-09-09T20:00:21.719969"}
Sep 09 22:00:21 authentik systemd-authentik-worker[128478]: {"domain_url": null, "event": "Backlogging tasks waiting for dependencies", "level": "debug", "logger": "django_dramatiq_postgres.broker", "pid": 18, "queue": "default", "schema_name": "public", "timestamp": "2026-09-09T20:00:21.720055"}
Sep 09 22:00:21 authentik systemd-authentik-worker[128478]: {"domain_url": null, "event": "Enqueueing message on queue", "level": "debug", "logger": "django_dramatiq_postgres.broker", "message_id": "40575b12-f2e1-4cac-bf83-15a04b6ca224", "pid": 18, "queue": "default", "schema_name": "public", "timestamp": "2026-09-09T20:00:21.725359"}
Sep 09 22:00:21 authentik systemd-authentik-worker[128478]: {"domain_url": null, "event": "Task enqueued", "level": "info", "logger": "authentik.tasks.middleware", "pid": 18, "schema_name": "public", "task_id": "40575b12-f2e1-4cac-bf83-15a04b6ca224", "task_name": "authentik.enterprise.tasks.enterprise_update_usage", "timestamp": "2026-09-09T20:00:21.729186"}
Sep 09 22:00:21 authentik systemd-authentik-worker[128478]: {"domain_url": null, "event": "Sent 1 scheduled tasks", "level": "info", "logger": "django_dramatiq_postgres.scheduler", "pid": 18, "schema_name": "public", "timestamp": "2026-09-09T20:00:21.733901"}
Sep 09 22:00:21 authentik systemd-authentik-worker[128478]: {"domain_url": null, "event": "Polling for message notifications", "level": "debug", "logger": "django_dramatiq_postgres.broker", "pid": 18, "queue": "default", "schema_name": "public", "timestamp": "2026-09-09T20:00:21.734330"}
Sep 09 22:00:21 authentik systemd-authentik-worker[128478]: {"channel": "authentik.tasks.default.enqueue", "domain_url": null, "event": "Finished receiving postgres notifies on channel", "level": "debug", "logger": "django_dramatiq_postgres.broker", "notifies": 1, "pid": 18, "schema_name": "public", "timestamp": "2026-09-09T20:00:21.734655"}
Sep 09 22:00:21 authentik systemd-authentik-worker[128478]: {"event": "Pushing message '40575b12-f2e1-4cac-bf83-15a04b6ca224' onto work queue.", "level": "debug", "logger": "dramatiq.worker.ConsumerThread(default)", "timestamp": "2026-09-09T20:00:21.738155"}
Sep 09 22:00:21 authentik systemd-authentik-worker[128478]: {"domain_url": null, "event": "Polling for message notifications", "level": "debug", "logger": "django_dramatiq_postgres.broker", "pid": 18, "queue": "default", "schema_name": "public", "timestamp": "2026-09-09T20:00:21.738234"}
Sep 09 22:00:21 authentik systemd-authentik-worker[128478]: {"event": "Received message authentik.enterprise.tasks.enterprise_update_usage() with id '40575b12-f2e1-4cac-bf83-15a04b6ca224'.", "level": "debug", "logger": "dramatiq.worker.WorkerThread", "timestamp": "2026-09-09T20:00:21.738440"}
Sep 09 22:00:21 authentik systemd-authentik-worker[128478]: {"domain_url": null, "event": "Task started", "level": "info", "logger": "authentik.tasks.middleware", "pid": 18, "schema_name": "public", "task_id": "40575b12-f2e1-4cac-bf83-15a04b6ca224", "task_name": "authentik.enterprise.tasks.enterprise_update_usage", "timestamp": "2026-09-09T20:00:21.753771"}
Sep 09 22:00:21 authentik systemd-authentik-worker[128478]: {"event": "Received args=() kwargs={}.", "level": "debug", "logger": "authentik.enterprise.tasks.enterprise_update_usage", "timestamp": "2026-09-09T20:00:21.756441"}
Sep 09 22:00:21 authentik systemd-authentik-worker[128478]: {"event": "Completed after 1.97ms.", "level": "debug", "logger": "authentik.enterprise.tasks.enterprise_update_usage", "timestamp": "2026-09-09T20:00:21.758510"}
Sep 09 22:00:21 authentik systemd-authentik-worker[128478]: {"domain_url": null, "event": "Task finished", "exc": null, "level": "info", "logger": "authentik.tasks.middleware", "pid": 18, "schema_name": "public", "task_id": "40575b12-f2e1-4cac-bf83-15a04b6ca224", "task_name": "authentik.enterprise.tasks.enterprise_update_usage", "timestamp": "2026-09-09T20:00:21.761030"}
Sep 09 22:00:21 authentik systemd-authentik-worker[128478]: {"event": "Acknowledging message '40575b12-f2e1-4cac-bf83-15a04b6ca224'.", "level": "debug", "logger": "dramatiq.worker.ConsumerThread(default)", "timestamp": "2026-09-09T20:00:21.765915"}
Sep 09 22:00:21 authentik systemd-authentik-worker[128478]: {"domain_url": null, "event": "Post-processing message", "level": "debug", "logger": "django_dramatiq_postgres.broker", "message": "40575b12-f2e1-4cac-bf83-15a04b6ca224", "pid": 18, "schema_name": "public", "state": "done", "timestamp": "2026-09-09T20:00:21.766001"}
```

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the failure with a Kerberos source sync after restarting kadmind or waiting several hours, then trace the Kerberos source sync job and its worker lifecycle. Compare password, keytab, and external ticket-cache behavior; done means sync continues successfully after ticket-context expiry and kadmind restarts without restarting the worker container.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
authentication, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.