goauthentik / goauthentik/authentik

LDAP Outpost: Custom `gidNumber` attribute is ignored in virtual-group-object if it is not a string, but the user-object accepts also a integer

Open
#9,533 5 comments 0 reactions 0 assignees View on GitHub
bug status/reviewing
Dominant language
Python
Stars
25.6k
Forks
2k
Avg merge
1d 1h
Merged PRs (30d)
644

Description

**Describe the bug**
If you set the value `gidNumber` as integer on a user, the ldap outpost will correctly set the gidNumber on the user object, but on the respective virtual group of the user it will be ignored and a auto-generated number will be used. The gidNumber as a string works on both user and virtual-group object.

This is a follow up issue of #7524

**To Reproduce**

Just set a gidNumber as an integer on the attributes of a user (in the screenshot it is a user named “raabf”)

![image](https://github.com/goauthentik/authentik/assets/4788201/48e41e70-4eb5-4662-a131-f4ec03a8c0c4)

If you query the LDAP outpost via an LDAP-tool, you will get the number on the user-object:

```
[...]
dn: cn=raabf,ou=users,dc=goauthentik,dc=io
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: user
objectClass: posixAccount
objectClass: goauthentik.io/ldap/user
cn: raabf
gidNumber: 1111
uidNumber: 1111
[...]
```

However, the virtal-group object of the user ignores gidNumber (even with #8003), and use an auto generated one:

```
dn: cn=raabf,ou=virtual-groups,dc=goauthentik,dc=io
sAMAccountName: raabf
ak-superuser: false
objectClass: group
objectClass: groupOfUniqueNames
objectClass: groupOfNames
objectClass: goauthentik.io/ldap/group
objectClass: posixGroup
objectClass: goauthentik.io/ldap/virtual-group
gidNumber: 2008
cn: raabf
[...]
```

If you set now the same number as a string

![image](https://github.com/goauthentik/authentik/assets/4788201/89d34a31-c89d-45e3-8f1d-70ccc6b2bde2)

then also the virtual-group object will use the custom set value:

```
dn: cn=raabf,ou=virtual-groups,dc=goauthentik,dc=io
sAMAccountName: raabf
ak-superuser: false
objectClass: group
objectClass: groupOfUniqueNames
objectClass: groupOfNames
objectClass: goauthentik.io/ldap/group
objectClass: posixGroup
objectClass: goauthentik.io/ldap/virtual-group
gidNumber: 1111
cn: raabf
[...]
```

**Expected behavior**
It was unexpected that a integer value is silently ignored by the virtual-group (The functionality in #8003 do not raise an error it seems and is just silent), I just find out by looking at the implementation. If you want to process the value as in string, I think the simplest thing is to always try to convert the value to a string at the beginning.

**Version and Deployment (please complete the following information):**

- authentik version: 2024.4.1
- Deployment: podman quadlets

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.