goauthentik / goauthentik/authentik
LDAP Outpost: Custom `gidNumber` attribute is ignored in virtual-group-object if it is not a string, but the user-object accepts also a integer
- Dominant language
- Python
- Stars
- 25.6k
- Forks
- 2k
- Avg merge
- 1d 1h
- Merged PRs (30d)
- 644
Description
**Describe the bug**
If you set the value `gidNumber` as integer on a user, the ldap outpost will correctly set the gidNumber on the user object, but on the respective virtual group of the user it will be ignored and a auto-generated number will be used. The gidNumber as a string works on both user and virtual-group object.
This is a follow up issue of #7524
**To Reproduce**
Just set a gidNumber as an integer on the attributes of a user (in the screenshot it is a user named “raabf”)

If you query the LDAP outpost via an LDAP-tool, you will get the number on the user-object:
```
[...]
dn: cn=raabf,ou=users,dc=goauthentik,dc=io
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: user
objectClass: posixAccount
objectClass: goauthentik.io/ldap/user
cn: raabf
gidNumber: 1111
uidNumber: 1111
[...]
```
However, the virtal-group object of the user ignores gidNumber (even with #8003), and use an auto generated one:
```
dn: cn=raabf,ou=virtual-groups,dc=goauthentik,dc=io
sAMAccountName: raabf
ak-superuser: false
objectClass: group
objectClass: groupOfUniqueNames
objectClass: groupOfNames
objectClass: goauthentik.io/ldap/group
objectClass: posixGroup
objectClass: goauthentik.io/ldap/virtual-group
gidNumber: 2008
cn: raabf
[...]
```
If you set now the same number as a string

then also the virtual-group object will use the custom set value:
```
dn: cn=raabf,ou=virtual-groups,dc=goauthentik,dc=io
sAMAccountName: raabf
ak-superuser: false
objectClass: group
objectClass: groupOfUniqueNames
objectClass: groupOfNames
objectClass: goauthentik.io/ldap/group
objectClass: posixGroup
objectClass: goauthentik.io/ldap/virtual-group
gidNumber: 1111
cn: raabf
[...]
```
**Expected behavior**
It was unexpected that a integer value is silently ignored by the virtual-group (The functionality in #8003 do not raise an error it seems and is just silent), I just find out by looking at the implementation. If you want to process the value as in string, I think the simplest thing is to always try to convert the value to a string at the beginning.
**Version and Deployment (please complete the following information):**
- authentik version: 2024.4.1
- Deployment: podman quadlets
Contributor guide
Assessment
This issue has not been assessed yet.