goauthentik / goauthentik/authentik
No warning when multiple providers with identical routing identifier used in same outpost
- Dominant language
- Python
- Stars
- 25.6k
- Forks
- 2k
- Avg merge
- 1d 1h
- Merged PRs (30d)
- 644
Description
**Describe the bug**
When having two applications (called A, B) bound to an LDAP outpost and A has a User/Group binding, the LDAP bind against B breaks with "Insufficient access" if the service account for B isn't allowed in A's user/group binding.
**To Reproduce**
* Create a group "hydra-users"
* Create a group "ldap-search" with two service accounts as members (called "nextcloud-user-sync" & "hydra")
* Create the applications "nextcloud user sync" & "hydra". Both are of type LDAP and use ldap-search as search group
* Create an LDAP outpost with both application providers being part of it.
* Add two user bindings to application Hydra: one allows access for the service user "hydra", the other grants access to the application to group "hydra-users"
* Bind as "nextcloud-user-sync" against the LDAP outpost
You'll get an "Insufficient access" error now whereas binding as "hydra" works fine.
The workaround is to grant "nextcloud-user-sync" access to the Hydra application.
**Expected behavior**
I'm not sure.
At first, I thought that this is clearly a bug, but then I realized that this is potentially expected behavior since you don't want to allow binding against an application with user/group restrictions (even if it's just the service account for another application).
OTOH this behavior was pretty unexpected to me, so I'd expect to have a warning at least in the UI. Or maybe even in the logs (i.e. `user denied because of user/group bindings from application hydra`).
Another option would be to always let the binds of service accounts through.
In other words: this may be an issue, but I'm not sure yet what's the best solution out of it.
**Screenshots**
n/a
**Logs**
n/a
**Version and Deployment (please complete the following information):**
- authentik version: 2024.2.2
- Deployment: NixOS 23.11 via https://github.com/nix-community/authentik-nix/
**Additional context**
n/a
Contributor guide
Assessment
This issue has not been assessed yet.