LDAP groups with different unique identifier as users / give a role to all LDAP users by default

[airblag]

Hello everyone,

I set up a authentik with 2 backends : OpenLDAP and MIT Kerberos. (with the same users in both).

In Kerberos, I was able to enable "Add REALM as group", and give my realm group basis authorization for the role "authentik read only".
So users authenticating with GSSAPI get access to the connected Applications.

For people authenticating with password against LDAP, they do not get any permission.

In my OpenLDAP, the users have a 'uid' unique identifier under ou=users,... they also have a 'cn' attribute, but it is filled with gecos information (First Lastname) which is not unique.

in ou=groups, my LDAP groups have cn as unique identifier.

So basically, I can not resolve LDAP groups because in the LDAP source under "advanced" there is one "Object uniqueness field" set to uid, but then it won't find any groups under the Additional Group DN.

I found this issue which is quite matching my situation, I also tried to configure 2 LDAP sources, one for the users and one for the groups, but users don't get associated to the groups
#4540

I actually do not need really to get the ldap groups in authentik (for now). I just want all my LDAP users to get the minimal permissions to access the OIDC Applications. Is there otherwise any easy trick to get all authenticated users from LDAP to get the minimal read-only role associated ?

Thanks, I am stuck since a few weeks on it

[airblag]

I used IA to find a solution for my problem. Because the official documentation is not helping for LDAP LDAP backends having posixGroup with memberUid attributes containing uid (and not DN).

For the "Object uniqueness field", I set it to entryUUID (setting it to uid was maybe prone to error)

Under "Customization -> Property Mappings", I add an "LDAP Source Property Mapping" with

return {"attributes": {"uid": list_flatten(ldap.get("uid"))}}

And add it to the User property mappings of my LDAP source.
Resync the LDAP and then the groups got filled up with my users.

IA says the code of authentik is otherwise expecting a full DN in the memberUid attribute.

Maybe it should be added somehow to the official documentation