-
-
Notifications
You must be signed in to change notification settings - Fork 1.5k
Description
Describe the bug
LDAP Sources are broken since commit 1ca8feb. This is due to a double bind that is attempted on the Connection object. The second bind consistently causes a LDAPInvalidCredentailResult exception even if it is successful the first bind. I found this bug after updating Authentik to 2023.5.3 wondering why LDAP logins no longer worked. The LDAP backend is consistently changing passwords due to TOTP so a cached password was never hit always forcing a LDAP bind. Which is what made me find this issue.
To Reproduce
- Set up a LDAP Source that works
- Login in as any user using the LDAP Password for that users THATS NOT CACHED
- User Always gets Invalid Credentials
Expected behavior
User should successfully login
Logs
None Provided
Version and Deployment (please complete the following information):
- authentik version: 2023.5.3
- Deployment: docker-compose
Additional context
I confirmed this bug on my own stack by creating multiple logging lines using LOGGER and checking DEBUG output. For some reason a second bind always causes this Exception with Authentik if the first was successful. I'm not sure if the state is reset per successful connection which is causing this. But by removing the extra bind performed in /authentik/sources/ldap/auth.py I no longer get erroneous invalid credential exceptions.