QNAP LDAP authentication set up not succesful

[Harald-Berghoff]

I installed authentik as a docker app on my Qnap NAS. Then I tried to enable LDAP authentication for this Qnap NAS against the authentik installed here. I want to enable SSO for the apps which includes the NAS. The OAuth for the docker apps is working fine.

To do so I followed the instruction here: https://integrations.goauthentik.io/infrastructure/qnap-nas/

But even after configuring as described, I have these points:

1. On the LDAP outpost I see LDAP queries for UID:

"Search request","filter":"(&(objectClass=user)(uidNumber=70))"

The UIDs seem to be from the process list of 'unkown' process users, as far as I see from processes within the docker containers, (70 is authentik accessing postgres, but from other docker apps as well) if the user ids are not configured in the NAS

2. Only the bind user is listed after a significant pause when entering 'getent passwd' (on the shell of NAS)

3. No group at all is listed (also with a significant pause) when entering 'getent group' (on the shell of NAS)

4. The NAS system configs lists the LDAP server as offline now online
   [EDIT]: the status is now given as online, a simple restart did the trick here. All other points are still unchanged.

5. The LDAP outpost is listed as ok in the dashboard

The connection seems to be basically working, otherwise there wouldn't be any LDAP queries for the unknown user on the NAS, but still something seems to be missing in order to make it work. One thing I suspect is that it may be a firewall issue, but found no way to verify this. The firewall is configured to allow https traffic, but blocks the LDAP ports. Still for LDAP authentication it shouldn't be routed via the client?

Any hint on how to track down or ideas to try solving this is appreciated.

[Harald-Berghoff]

To verify where the issue may be located, I installed Apache Directory Studio and connected to the LDAP outpost. When I use akadmin as the bind user, I get all users and groups displayed. But if I use the bind user created for the ldap, there is a significant delay in the response and the only the bind user is displayed as a user.

So I think it is a configuration/permission issue for the ldap bind user that I configured. I still appreciate any hint on this, of course I will try to check with the documentation if there is a hint of misconfiguration (I will not use akadmin at all as the bind user).

[Harald-Berghoff]

I obviously created just a group to allow ldap searches, not a role (my mistake, the documentation is fine and explains to create a role). groups can't be given the permission to run ldap queries, it must be role.

Having configured this the queries return users and groups. I have still a performance issue, but only on the NAS, it seems the NAS floods the LDAP outpost with queries by userids and groupids, repeativly for the numeric only ids, which aren't in the /etc/passwd or /etc/group of the NAS, which happens when running some docker container.

But: No issue with authentik, just a misconfiguration from myself. For the query flooding I will investigate on the QNAP side and also docker configs