When LDAP is configured, then normal email logins can be blocked if LDAP server is slow/down
@nvoxland is already working on this.
Since Mar 10, 2026.
- Dominant language
- Clojure
- Stars
- 49.3k
- Forks
- 6.8k
- Avg merge
- 1d 13h
- Merged PRs (30d)
- 653
Description
Describe the bug
When LDAP is configured, then normal email users (example the initially created admin user) also causes lookup on LDAP on every login, which is generally slower and unwanted, but if the LDAP server is slow/down, then it's very difficult to login.
Workaround Start Metabase with LDAP disabled via the environment variable MB_LDAP_ENABLED=false
https://www.metabase.com/docs/latest/operations-guide/environment-variables.html#mb_ldap_enabled
Or alternatively, use the environment variables to change the LDAP server host if needed.
To Reproduce
- Admin > Settings > Authentication > LDAP - setup, so it works.
- Look at the LDAP debug log, when trying to login with the initial Metabase admin user, which is
core_user.ldap_auth=false.
It will show lookups in the LDAP log.
6273e7ee conn=1009 fd=18 ACCEPT from IP=172.17.0.1:59102 (IP=0.0.0.0:389)
6273e7ee conn=1009 op=0 BIND dn="cn=Manager,dc=metabase,dc=local" method=128
6273e7ee conn=1009 op=0 BIND dn="cn=Manager,dc=metabase,dc=local" mech=SIMPLE ssf=0
6273e7ee conn=1009 op=0 RESULT tag=97 err=0 text=
6273e7f8 conn=1009 op=1 SRCH base="ou=people,dc=metabase,dc=local" scope=2 deref=0 filter="(&(mail=test@test.test))"
6273e7f8 conn=1009 op=1 SRCH attr=*
6273e7f8 conn=1009 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text=
6273e802 conn=1009 op=2 UNBIND
6273e802 conn=1009 fd=18 closed
- Simulating a terrible connection or the LDAP server might have moved - example:
tc qdisc add dev docker0 root netem delay 65s - Trying to login now will just result in timeout.
Expected behavior
- Email+password users should always be allowed to login.
- There's no reason to do a lookup on LDAP for email users (
core_user.ldap_auth=false).
Note Will this impact existing setups, which have created users on Metabase, and then kinda don't know where the authentication is happening? Until there's a way to configure password logins enabled/disabled, then it might be difficult to know metabase/metabase#11322
Information about your Metabase Installation:
Tested 0.42.4 and 0.43.0
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.