Skip to content

core, providers/ldap: add parent/child groups to api and ldap results#14974

Merged
rissson merged 7 commits intogoauthentik:mainfrom
danieladugyan:providers/ldap/add-child-groups
Aug 4, 2025
Merged

core, providers/ldap: add parent/child groups to api and ldap results#14974
rissson merged 7 commits intogoauthentik:mainfrom
danieladugyan:providers/ldap/add-child-groups

Conversation

@danieladugyan
Copy link
Contributor

@danieladugyan danieladugyan commented Jun 9, 2025

Details

Closes #2417

This PR adds a children/childrenObj field to the core groups API and a memberOf attribute for LDAP groups. The member attribute is also extended to show both users and child groups. An include_children parameter is also added to the API, similar to include_users/include_groups, to control the inclusion of child groups in responses. Finally, serializers and queries are updated to accommodate these changes.

Breaking changes? Since this is my first PR I am unsure if these are considered breaking changes. The core API just gets some additional fields/parameters so I would think not. As for the LDAP outpost changes, the results are again just extended with child groups and listing groups as member is expected behaviour IMO.

Background: #2417 details how the LDAP results currently don't show parent/child groups. We are currently trying to migrate to authentik from FreeIPA, but we have other systems that depend on getting this information from its LDAP server. This PR would solve the issue for us.

Checklist

  • Local tests pass (ak test authentik/)
  • The code has been formatted (make lint-fix)

If an API change has been made

  • The API schema has been updated (make gen-build)

If changes to the frontend have been made

  • The code has been formatted (make web)

If applicable

  • The documentation has been updated
  • The documentation has been formatted (make website)

@danieladugyan danieladugyan requested review from a team as code owners June 9, 2025 09:58
@netlify
Copy link

netlify bot commented Jun 9, 2025 •
edited
Loading

✅ Deploy Preview for authentik-docs ready!

Name Link
🔨 Latest commit a28f3d5
🔍 Latest deploy log https://app.netlify.com/projects/authentik-docs/deploys/688f78d673577a0008a7c0e1
😎 Deploy Preview https://deploy-preview-14974--authentik-docs.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

@netlify
Copy link

netlify bot commented Jun 9, 2025 •
edited
Loading

✅ Deploy Preview for authentik-storybook canceled.

Name Link
🔨 Latest commit a28f3d5
🔍 Latest deploy log https://app.netlify.com/projects/authentik-storybook/deploys/688f78d67aa547000844c47c

@codecov
Copy link

codecov bot commented Jun 17, 2025 •
edited
Loading

Codecov Report

Attention: Patch coverage is 78.94737% with 4 lines in your changes missing coverage. Please review.

Project coverage is 70.01%. Comparing base (fad6ac7) to head (7e69e65).
Report is 92 commits behind head on main.

Files with missing lines Patch % Lines
authentik/core/api/groups.py 78.94% 4 Missing ⚠️

❗ There is a different number of reports uploaded between BASE (fad6ac7) and HEAD (7e69e65). Click for more details.

HEAD has 15 uploads less than BASE
Flag BASE (fad6ac7) HEAD (7e69e65)
unit 15 4
e2e 8 4
Additional details and impacted files 
@@             Coverage Diff             @@
##             main   #14974       +/-   ##
===========================================
- Coverage   92.78%   70.01%   -22.78%     
===========================================
  Files         818      818               
  Lines       42199    42218       +19     
===========================================
- Hits        39156    29557     -9599     
- Misses       3043    12661     +9618
Flag Coverage Δ
e2e 44.86% <52.63%> (-2.91%) ⬇️
integration 24.43% <0.00%> (-0.02%) ⬇️
unit 66.91% <78.94%> (-23.76%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@rissson
Copy link
Member

rissson commented Jun 18, 2025

I'd rather allow filtering groups by their parent. So you'd be able to say /api/v3/core/groups/?parent=123
Adding a children attribute to the response makes it look like it might include all children recursively, which this PR doesn't do.

@rissson
Copy link
Member

rissson commented Jun 18, 2025

Ah, I didn't see that this was actually meant for the LDAP outpost. In that case, I'll let @BeryJu weigh in

BeryJu
BeryJu reviewed Jul 31, 2025
View reviewed changes
Copy link
Member

@BeryJu BeryJu left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Lgtm aside from the default, I also wish we could narrow it down from 3 different serializers for groups but alas

@danieladugyan danieladugyan force-pushed the providers/ldap/add-child-groups branch from 7e69e65 to a67c894 Compare August 3, 2025 08:39
@netlify
Copy link

netlify bot commented Aug 3, 2025 •
edited
Loading

✅ Deploy Preview for authentik-integrations ready!

Name Link
🔨 Latest commit a28f3d5
🔍 Latest deploy log https://app.netlify.com/projects/authentik-integrations/deploys/688f78d6a6d0de0008976da6
😎 Deploy Preview https://deploy-preview-14974--authentik-integrations.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

@danieladugyan danieladugyan force-pushed the providers/ldap/add-child-groups branch from a67c894 to 9c0326b Compare August 3, 2025 08:49
@danieladugyan danieladugyan force-pushed the providers/ldap/add-child-groups branch from 9c0326b to ce928f1 Compare August 3, 2025 13:40
@danieladugyan danieladugyan requested a review from a team as a code owner August 3, 2025 14:57
@danieladugyan
Copy link
Contributor Author

danieladugyan commented Aug 3, 2025

Lgtm aside from the default, I also wish we could narrow it down from 3 different serializers for groups but alas

@BeryJu Thanks for the review. I've updated the branch with your feedback, retested everything to ensure it still works, and also refreshed some now-outdated documentation to reflect the changes.

@rissson rissson merged commit ab1f87c into goauthentik:main Aug 4, 2025
103 checks passed
kensternberg-authentik added a commit that referenced this pull request Aug 6, 2025
@kensternberg-authentik
Merge branch 'main' into dev
b60bfad 
* main: (77 commits)
  website/integrations: add hass-openid instructions (#14672)
  core: add updated_at field to user (#15571)
  root: Add more opencontainer labels to Dockerfiles (#15923)
  core: bump goauthentik.io/api/v3 from 3.2025064.2 to 3.2025064.3 (#15949)
  core, providers/ldap: add parent/child groups to api and ldap results (#14974)
  web: Make Webdriver optional during install. (#15952)
  core, web: update translations (#15945)
  packages/django-dramatiq-postgres: fix typo (#15932)
  web: bump API Client version (#15942)
  core: fix flow planner checking against wrong user when creating recovery link (#15390)
  providers/saml: configuration for default NameID Policy (#15109)
  core: bump boto3 from 1.39.15 to v1.40.1 (#15926)
  core: bump jsii from 1.112.0 to v1.113.0 (#15927)
  core: bump argon2-cffi-bindings from 21.2.0 to v25.1.0 (#15925)
  core: bump aiohttp from 3.12.14 to v3.12.15 (#15924)
  core: bump opentelemetry-api from 1.35.0 to v1.36.0 (#15928)
  web/admin: fix variable name (#15934)
  policies: fix typo (#15933)
  web: bump @sentry/browser from 9.43.0 to 10.0.0 in /web in the sentry group across 1 directory (#15911)
  core: bump github.com/prometheus/client_golang from 1.22.0 to 1.23.0 (#15908)
  ...
@danieladugyan danieladugyan mentioned this pull request Sep 22, 2025
Merged
6 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@BeryJu BeryJu BeryJu approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

LDAP - Querying groups should show information of parent/child groups using member and memberOf attributes

3 participants

@danieladugyan @rissson @BeryJu