"Search full LDAP directory" doesn't actually work

[Banh-Canh]

Describe the bug "Search full LDAP directory" doesn't actually work.

To Reproduce Steps to reproduce the behavior:

Add "Search full LDAP directory" permission to a freshly created user/serviceaccount. Then run the query:

ldapsearch -x -H ldap://<outpost-ldap>:389 -D 'cn=ldapbind,ou=users,DC=ldap,DC=goauthentik,DC=io'  -w 'xxx'  -b 'OU=users,DC=ldap,DC=goauthentik,DC=io' '(objectClass=user)

It only returns the binduser. If I ran the same command after I gave superuser permission to the bind user, it just work and i get the whole directory of users.

Expected behavior I should get the whole directory of user with this permission without superuser rights.

Version and Deployment (please complete the following information):

• authentik version: 2024.8.3
• Deployment: helm

[shawnbonifas]

I'm having the same issue here. I only just today set up the LDAP application, outpost, provider, flows, etc. so I don't know if it was working previously. If I use the akadmin account I can search for users and see all of them. Using the service account I created it can only find itself and the groups it's a member of. I have tried giving it superuser permission, all LDAP permissions, and all permissions to users the user search still only returns the bind user. I'm also using 2024.8.3, deployed using the helm template.

[DrMax1]

Same issue here. Using the "Search full LDAP directory" permission to the bind user makes the query only return the bind user itself. After adding the bind user to the superuser group it returns all users in the current authentik instance.

Running 2024.8.3 with docker-compose

[BeryJu]

@DrMax1 @shawnbonifas @Banh-Canh are you assigning the search full LDAP directory to the service user within a single provider or globally?

Also try restarting the LDAP outpost after the permissions are assigned, this might be a caching part (it shouldn't but just to rule it out)

[DrMax1]

@DrMax1 @shawnbonifas @Banh-Canh are you assigning the search full LDAP directory to the service user within a single provider or globally?

Also try restarting the LDAP outpost after the permissions are assigned, this might be a caching part (it shouldn't but just to rule it out)

@BeryJu I am assigning the permission to the service user globally:

I restarted the LDAP outpost and also set the provider to direct binding and querying to avoid caching issues.

I also tried downgrading to Version 2024.8.2 but the issue persists.

[francescor]

We confirm this bug: lost a lot of hours debugging today: the problem is with 2024.8.3 while it's OK with 2024.6.1

In https://version-2024-8.goauthentik.io/docs/providers/ldap/ I read

INFO Up to authentik version 2024.8 this was managed using the "Search group" attribute in the LDAP Provider, where users could be added to a group to grant them this permission. With authentik 2024.8 this is automatically migrated to the "Search full LDAP directory" permission, which can be assigned more flexibly.

So, we are stuck

[francescor]

These are the relative commits https://github.com/goauthentik/authentik/pull/10639

Updated: ~maybe we can solve this by working with roles?~

[DrMax1]

These are the relative commits #10639

maybe we can solve this by working with roles?

Do you mean creating a role, assigning the "Search full LDAP directory" permission to said role, assigning this role to a group and then adding the relevant service users?

I tried it and it doesn't work either unfortunately. I think there must be an issue with the the permission in the authorization code.

[francescor]

I've figured out how to allow a user, in the context of this issue, to "Search full LDAP directory" without the need to make it a superuser (so without make it member of authentik Admins): as stated in the first comment in https://github.com/goauthentik/authentik/pull/10639 we need to use object permissions and not global permissions as we all did so far :(

So you need to have this

which can be accomplish by Application/Provider/Ldap Permissions TAB, then Assign new User

this way we have:

Et voilà

[francescor]

so I guess this issue can be easily solved just with few words in documentation

[DrMax1]

This actullay solved the problem! Thanks for tinkering around and finding the solution! :)

Would you mind starting a PR to add this to the documentation so it can help future users?

[perrze]

I've figured out how to allow a user, in the context of this issue, to "Search full LDAP directory" without the need to make it a superuser (so without make it member of authentik Admins): as stated in the first comment in #10639 we need to use object permissions and not global permissions as we all did so far :(

When you added the permission, did you need to restart the outpost container ? Because on my instance it was the only way that the permissions would be applied.

[francescor]

When you added the permission, did you need to restart the outpost container ? Because on my instance it was the only way that the permissions would be applied.

no, but you must be aware of the CACHE which I kept disable till I solve all setup

so, with a restart you probably flush caches