goauthentik / goauthentik/authentik

No warning when multiple providers with identical routing identifier used in same outpost

Open
#9,245 9 comments 0 reactions 0 assignees View on GitHub
bug bug/confirmed
Dominant language
Python
Stars
25.6k
Forks
2k
Avg merge
1d 1h
Merged PRs (30d)
644

Description

**Describe the bug**
When having two applications (called A, B) bound to an LDAP outpost and A has a User/Group binding, the LDAP bind against B breaks with "Insufficient access" if the service account for B isn't allowed in A's user/group binding.

**To Reproduce**

* Create a group "hydra-users"
* Create a group "ldap-search" with two service accounts as members (called "nextcloud-user-sync" & "hydra")
* Create the applications "nextcloud user sync" & "hydra". Both are of type LDAP and use ldap-search as search group
* Create an LDAP outpost with both application providers being part of it.
* Add two user bindings to application Hydra: one allows access for the service user "hydra", the other grants access to the application to group "hydra-users"
* Bind as "nextcloud-user-sync" against the LDAP outpost

You'll get an "Insufficient access" error now whereas binding as "hydra" works fine.
The workaround is to grant "nextcloud-user-sync" access to the Hydra application.

**Expected behavior**

I'm not sure.
At first, I thought that this is clearly a bug, but then I realized that this is potentially expected behavior since you don't want to allow binding against an application with user/group restrictions (even if it's just the service account for another application).

OTOH this behavior was pretty unexpected to me, so I'd expect to have a warning at least in the UI. Or maybe even in the logs (i.e. `user denied because of user/group bindings from application hydra`).

Another option would be to always let the binds of service accounts through.

In other words: this may be an issue, but I'm not sure yet what's the best solution out of it.

**Screenshots**
n/a

**Logs**
n/a

**Version and Deployment (please complete the following information):**

- authentik version: 2024.2.2
- Deployment: NixOS 23.11 via https://github.com/nix-community/authentik-nix/

**Additional context**
n/a

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.