LDAP Bind error from Jellyfin

[neat jolt]

I followed the guide from Authentik.io exactly and I can connect find, but the bind fails from Jellyfin. I structured my base DN like: dc=auth,dc=authentik,dc=com
and my bind user like:
CN=ldapsearch,OU=groups,DC=auth,DC=authentik,DC=com
also tried:
CN=ldapservice,OU=users,DC=auth,DC=id10tips,DC=com
None of these seem to work, and when I go into Providers and edit the LDAP one created it shows my base DN as being:
cn=myadmin,ou=users,dc=auth,dc=authentik,dc=com
rather than the ldap service account created. I did test Jellyfin by using that exact path and the password setup for my admin account and it didn't work. My admin account was a member of the LDAP group created during the guide. Not sure what the issue is or if that base DN in providers is an example or what I am supposed to actually use. If so, can I change it?

[vague beacon]

I have it set up, but probably not in the way you are supposed to 😄 . Not sure if you are trying to achieve the same, but check my comment in the reddit post here
https://www.reddit.com/r/selfhosted/comments/sp9vlb/authentik_jellyfin/

[neat jolt]

That zerobin link times out for me

[vague beacon]

Ah sry about that. I think this is the correct file:

<?xml version="1.0" encoding="utf-8"?>
<PluginConfiguration xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
  <LdapServer>192.168.1.4</LdapServer>
  <LdapPort>389</LdapPort>
  <UseSsl>false</UseSsl>
  <UseStartTls>false</UseStartTls>
  <SkipSslVerify>false</SkipSslVerify>
  <LdapBindUser>cn=ldapsearchaccount,ou=users,dc=jellyfin,dc=ldap,dc=DOMAIN,dc=com</LdapBindUser>
  <LdapBindPassword>PASSWORD_OF_LDAP_SEARCH_USER</LdapBindPassword>
  <LdapBaseDn>dc=jellyfin,dc=ldap,dc=DOMAIN,dc=com</LdapBaseDn>
  <LdapSearchFilter>(objectClass=user)</LdapSearchFilter>
  <LdapAdminBaseDn />
  <LdapAdminFilter>(memberOf=cn=jellyfinAdmin,ou=groups,dc=jellyfin,dc=ldap,dc=DOMAIN,dc=com)</LdapAdminFilter>
  <LdapSearchAttributes>cn</LdapSearchAttributes>
  <EnableCaseInsensitiveUsername>true</EnableCaseInsensitiveUsername>
  <CreateUsersFromLdap>true</CreateUsersFromLdap>
  <AllowPassChange>false</AllowPassChange>
  <LdapUsernameAttribute>cn</LdapUsernameAttribute>
  <LdapPasswordAttribute>userPassword</LdapPasswordAttribute>
  <EnableAllFolders>true</EnableAllFolders>
  <EnabledFolders>
    <string>0c41907140d802bb58430fed7e2cd79e</string>
    <string>19ec44a31412ba346d86c2273691e0cf</string>
    <string>fa1162e3b3b60eaa16e13941dbaac417</string>
    <string>ec15ab157fb4eba976f82e99b85c778d</string>
  </EnabledFolders>
  <PasswordResetUrl />
</PluginConfiguration>

[young birch]

nevermind i was confused, what Gogo did above should work

[neat jolt]

So is your domain "jellyfin.ldap.domain.com"?

ou=users,dc=jellyfin,dc=ldap,dc=DOMAIN,dc=com

[neat jolt]

Big sigh. Honestly, I know how to use LDAP with my Windows Server so I think I am going to just keep doing that. Authentik is just really frustrating me and it is not easy to use whatsoever.

[craggy canopy]

take a look at the organizr integration configuration and see if something pop's out to you https://goauthentik.io/integrations/services/organizr/#organizr-configuration

[trail plume]

Did you manage to find a solution with Authentik? I'm facing the exact same issue

[neat jolt]

No. I actually just stopped using Authentik. Maybe I will pick it up again someday but I just found it waaaayyy too much of a pain in the ass for my uses. Sorry, I hope you figure it out.

[topaz hatch]

I might be way off here, but from this article: https://goauthentik.io/docs/providers/ldap/generic_setup

It looks like the base DN of "dc=ldap,dc=goauthentik,dc=io" is not flexible. There's also text alluding to the default port of the LDAP outpost being port 3389, but I'm not certain. Either way, if you do decide to give Authentik another go, you may consider:

1. Ensure the LDAP outpost is configured for port 389 (636 for LDAPS); Or otherwise bind your app to 3389
2. Use the base DN of "dc=ldap,dc=goauthentik,dc=io"

[young birch]

<something>.goauthentik.io is a placeholder for your <something>.<yourDomainHere>.<yourTLDHere>

e.g if your domain is ehlo.com and authentik is located in ldap.ehlo.com then it would be
ldap ehlo com