metabase / metabase/metabase

When LDAP is configured, then normal email logins can be blocked if LDAP server is slow/down

Open
#22,459 3 comments 2 reactions 1 assignee View on GitHub

@nvoxland is already working on this.

Since Mar 10, 2026.

.Backend .Team/UXWest .Triaged Dec 2025 Administration/Auth Difficulty:Medium Priority:P3 Type:Bug
Dominant language
Clojure
Stars
49.3k
Forks
6.8k
Avg merge
1d 13h
Merged PRs (30d)
653

Description

Describe the bug
When LDAP is configured, then normal email users (example the initially created admin user) also causes lookup on LDAP on every login, which is generally slower and unwanted, but if the LDAP server is slow/down, then it's very difficult to login.

Workaround Start Metabase with LDAP disabled via the environment variable MB_LDAP_ENABLED=false
https://www.metabase.com/docs/latest/operations-guide/environment-variables.html#mb_ldap_enabled
Or alternatively, use the environment variables to change the LDAP server host if needed.

To Reproduce

  1. Admin > Settings > Authentication > LDAP - setup, so it works.
  2. Look at the LDAP debug log, when trying to login with the initial Metabase admin user, which is core_user.ldap_auth=false.
    It will show lookups in the LDAP log.
6273e7ee conn=1009 fd=18 ACCEPT from IP=172.17.0.1:59102 (IP=0.0.0.0:389)
6273e7ee conn=1009 op=0 BIND dn="cn=Manager,dc=metabase,dc=local" method=128
6273e7ee conn=1009 op=0 BIND dn="cn=Manager,dc=metabase,dc=local" mech=SIMPLE ssf=0
6273e7ee conn=1009 op=0 RESULT tag=97 err=0 text=
6273e7f8 conn=1009 op=1 SRCH base="ou=people,dc=metabase,dc=local" scope=2 deref=0 filter="(&(mail=test@test.test))"
6273e7f8 conn=1009 op=1 SRCH attr=*
6273e7f8 conn=1009 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text=
6273e802 conn=1009 op=2 UNBIND
6273e802 conn=1009 fd=18 closed
  1. Simulating a terrible connection or the LDAP server might have moved - example:
    tc qdisc add dev docker0 root netem delay 65s
  2. Trying to login now will just result in timeout.

Expected behavior

  • Email+password users should always be allowed to login.
  • There's no reason to do a lookup on LDAP for email users (core_user.ldap_auth=false).
    Note Will this impact existing setups, which have created users on Metabase, and then kinda don't know where the authentication is happening? Until there's a way to configure password logins enabled/disabled, then it might be difficult to know metabase/metabase#11322

Information about your Metabase Installation:
Tested 0.42.4 and 0.43.0

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.