Skip to content

LDAP Source Bind from Federation & Social login is Broken Since Commit 1ca8feb #5920

@ReaHe

Description

@ReaHe

Describe the bug
LDAP Sources are broken since commit 1ca8feb. This is due to a double bind that is attempted on the Connection object. The second bind consistently causes a LDAPInvalidCredentailResult exception even if it is successful the first bind. I found this bug after updating Authentik to 2023.5.3 wondering why LDAP logins no longer worked. The LDAP backend is consistently changing passwords due to TOTP so a cached password was never hit always forcing a LDAP bind. Which is what made me find this issue.

To Reproduce

  1. Set up a LDAP Source that works
  2. Login in as any user using the LDAP Password for that users THATS NOT CACHED
  3. User Always gets Invalid Credentials

Expected behavior
User should successfully login

Logs
None Provided

Version and Deployment (please complete the following information):

  • authentik version: 2023.5.3
  • Deployment: docker-compose

Additional context
I confirmed this bug on my own stack by creating multiple logging lines using LOGGER and checking DEBUG output. For some reason a second bind always causes this Exception with Authentik if the first was successful. I'm not sure if the state is reset per successful connection which is causing this. But by removing the extra bind performed in /authentik/sources/ldap/auth.py I no longer get erroneous invalid credential exceptions.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions