Skip to content

LDAP Outpost Constantly Restarting #5845

@FirbyKirby

Description

@FirbyKirby

Describe the bug
The LDAP outpost is stuck in a restart loop indefinitely.

To Reproduce
Steps to reproduce the behavior:

  1. Set up an application that uses 2 providers such that the back channel is LDAP (for my issue, primary was OIDC.)
  2. Deploy the LDAP outpost (if it's not already.)
  3. Observe the log to see a loop of events stating "added outpost instance to cache," an API call to the outpost, and then "removed outpost instance from cache."
  4. Observe the outpost container being removed and then added repeatedly.

Expected behavior
The LDAP outpost should remain deployed when an application has an LDAP provider configured for back channel.

Screenshots
image

Logs
Here is one example of the loop (this is all messages from this second of time in the authentik log.) This repeats periodically. I've stripped down the JSON to just the event, but can provide the full log on request.


06/03/2023 9:58:19 PM

    event=/api/v3/outposts/instances/ 

06/03/2023 9:58:19 PM

    event=/api/v3/root/config/ 

06/03/2023 9:58:19 PM

    event=/ws/outpost/ceaa76fe-50f4-446c-8ad8-70422d9a3e97/ 

06/03/2023 9:58:19 PM

    event=added outpost instance to cache 

06/03/2023 9:58:19 PM

    event=/api/v3/outposts/ldap/ 

06/03/2023 9:58:19 PM

    event=removed outpost instance from cache 

Version and Deployment (please complete the following information):

  • authentik version: [e.g. 2023.5.3]
  • Deployment: Unraid via docker (not docker-compose)

Additional context
When I edit the application to include just a single LDAP provider (removed the primary provider and "moved up" the LDAP back channel provider,) the issue resolves. The outpost deploys and stays deployed. LDAP authentication works, and the log entries stop.

Note that this issue seemed to begin after I upgraded to 2023.5.3. I was quick to pull that revision down because I was experiencing the issue detailed in Issue #5810, and resolved by PR #5812.

This issue was first opened in the Authentik discord and additional information can be found there.

Workaround
Set up two duplicate applications. One for each provider, and both with the same group permissions. Not ideal since duplicate applications on Authentik's user interface leads to confusion by users, but it's better then nothing.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions