#Cannot authenticate against LDAP outpost

1 messages · Page 1 of 1 (latest)

wary siren
#

Hello i'm struggling try to make LDAP outpost work but get Invalid credentials (49) error.
I followed the tutorial for LDAP outpost.

Here are the relevant logs :

2023-07-08T16:22:21+0200 25455f70b100[754]: {"bindDN":"cn=cyrus,ou=users,dc=example,dc=org","event":"authenticated from session","level":"info","logger":"authentik.outpost.ldap.binder.session","timestamp":"2023-07-08T14:22:21Z"}
2023-07-08T16:22:21+0200 25455f70b100[754]: {"bindDN":"cn=cyrus,ou=users,dc=example,dc=org","client":"10.50.12.8","event":"Bind request","level":"info","requestId":"444d314a-5041-47c2-b4af-bda34e265cb7","timestamp":"2023-07-08T14:22:21Z","took-ms":0}

Here is my config :

  • User :
    • name : cyrus
    • path: apps
  • Group :
    • name: apps
    • members : cyrus
  • Provider :
    • name: cyrus-ldap
    • bind flow : ldap-authentication-flow (ldap-authentication-flow)
    • search group : apps
    • base dn : dc=example,dc=org
  • Application :
    • name : cyrus
    • provider : cyrus-ldap
    • (testing application access in web ui works for user cyrus)
  • Outpost :
    • name: ldap
    • type : LDAP
    • integration : docker
    • applications : cyrus (cyrus-ldap)
    • (outpost is healthy)
  • Flow :
    • name: ldap-authentication-flow
    • designation : authentication
    • authentication : no requirement
    • stage bindings :
      • name : ldap-identification-stage
        order : 10
      • name : ldap-authentication-login
        order : 30

I can successfully log into web ui but not to LDAP outpost.
Commands tested :

ldapsearch -H ldap://ip -D cn=cyrus,dc=example,dc=org \
  -w xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx \
  -b dc=example,dc=org '(objectClass=user)'

also with cn=cyrus,ou=users,dc=example,dc=org
      and cn=cyrus,ou=apps,dc=example,dc=org

Is there a way i can dump the content of the LDAP or get more verbose logs ? (the outpost is already set in debuglog level)
Thanks

hard fjord
#

You are missing a password-stage in your flow.
You can select one inside ldap-identification-stage

wary siren
#

It's already selected

image.png
wary siren
#

ah finally i catched an error, after I delete the ldap container, make goauthentik recreate it, and then first login with user :

2023-07-08T17:45:26+0200 ldap 844480a7c4bb[753]: {"bindDN":"cn=cyrus,ou=users,dc=example,dc=org","client":"10.x.x.x","error":"exceeded stage recursion depth","event":"failed to execute flow","level":"warning","requestId":"8de0af84-376e-4775-bf4b-2860966c6b0e","timestamp":"2023-07-08T15:45:26Z"}
#

When the failed login is cached, the error doesn't show anymore

#

Still i dunno how to fix this

wary siren
broken pewter
#

I would personally create a seperate password stage and not tie it to the identification stage. The point of that feature in the identification stage is to allow the user to enter the username password in the gui on the same stage/page. Because LDAP does not involve a gui, I'm not sure how the outpost reacts to what you did. I know I've gotten it working by having two clearly seperate stages. So I would try that.

#

Another user in general though also mentioned having ldap issues with 2023.6, so maybe downgrading is worth a try as well

wary siren
#

Thanks for the answer.
I've already downgraded authentik to 2023.5.5 and also tried a separate stage for the password like this

image.png
#

So far no success with LDAP

broken pewter
#

Set the ldap outpost to noncached if you can, so direct search and direct bind. What specific passwords did you allow in the password stage?

wary siren
#

Here is how the password stage is configured

image.png
#

The provider is confgured with Direct bindingand Direct Querying

#

The user cyrusis member of group apps

#

As seen in the logs, the authentication is successfull :

{
  "auth_via": "unauthenticated",
  "backend": "authentik.core.auth.TokenBackend",
  "event": "Successful authentication",
  "host": "server:9000",
  "level": "info",
  "logger": "authentik.stages.password.stage",
  "pid": 21,
  "request_id": "86aee252771a45148d1ae738a554a09e",
  "timestamp": "2023-07-09T08:51:00.366425",
  "user": "cyrus"
}
#

but then i enter a recursive loop :

{
  "bindDN":"cn=cyrus,ou=users,dc=example,dc=org",
  "client":"10.50.12.8",
  "error":"exceeded stage recursion depth",
  "event":"failed to execute flow",
  "level":"warning",
  "requestId":"8dcd5de4-c610-41cd-a235-ab2759e815c0",
  "timestamp":"2023-07-09T08:51:00Z"
}
broken pewter
#

How did you create the ldap outpost? Using the authentik gui?

#

And can you get the docker compose logs as well to see if has more verbose errors?

wary siren
#

Yup the LDAP outpost was created with GUI. Several times...

wary siren
# 
CONTAINER ID   IMAGE                                 COMMAND                  CREATED          STATUS                             PORTS                                                    NAMES
c04a3d82294e   ghcr.io/goauthentik/ldap:2023.5.5     "/ldap"                  11 seconds ago   Up 11 seconds (healthy)            9300/tcp, 0.0.0.0:389->3389/tcp, 0.0.0.0:636->6636/tcp   ldap
f6f745ff77f0   ghcr.io/goauthentik/server:2023.5.5   "/bin/bash -c 'cp /c…"   2 hours ago      Up 23 seconds (health: starting)                                                            worker
fe144ce66fe7   ghcr.io/goauthentik/server:2023.5.5   "/usr/local/bin/dumb…"   2 hours ago      Up 23 seconds (health: starting)   10.50.12.7:9000->9000/tcp, 10.50.12.7:9443->9443/tcp     server
252305f7fd9b   tecnativa/docker-socket-proxy         "/docker-entrypoint.…"   2 hours ago      Up 23 seconds                      2375/tcp                                                 dockerproxy
4604ffadd15b   redis:alpine                          "docker-entrypoint.s…"   2 hours ago      Up 23 seconds (health: starting)   6379/tcp                                                 redis
5a8b0e5180df   postgres:12-alpine                    "docker-entrypoint.s…"   2 hours ago      Up 23 seconds (health: starting)   5432/tcp                                                 postgresql
broken pewter
#

what does

docker-compose logs

say for the whole stack?

#

such as the server and worker?

wary siren
#

Hello, sorry for the delay, here are the full logs with :

  • docker-compose up -d
  • successfull web authentication with user cyrus
  • failed ldap authentication with user cyrus
broken pewter
#

So looking at the logs and based off of the error messages you mentioned. It seems that the outpost is failing at trying to even test the user authentication.

In the go code itself, it produces the recursion error on the outpost. Essentially the recursion error (which seems to default to 10 attempts) is the outpost trying to perform the challenge request (whatever that means, didnt look much further) and its just not working. And in the logs, it shows this exact problem, specifically the outpost attempts to authenticate the user several times for one auth request. It first performs a GET, then a POST and then redirects and does the whole transaction again with no progress. So there's clearly a communication issue.

Another weird thing in those recent logs is that the ldap outpost checks in from 10.50.0.7, however the ldap outpost performing auth requests has a source ip of 10.50.0.1. I believe the remote_ip could actually be reflecting who's attempting the ldap request which would show the docker gateway but I saw this as interesting.

Overall I was hoping I would see an error but I don't see one. There is clearly a communication issue though. Makes me wonder what about the ldap might be configured incorrectly.

#

And I imagine it's showing healthy in the gui

wary siren
#

First, thank you for the time you spend analyzing my problem.

#

The output is seen healthy

image.png
#

The LDAP outpost has IP 10.50.0.7
10.50.0.1 is the gateway on the docker bridge

#

I make the LDAP requests from the VM hosting the containers, that's why you see the real client IP as 10.50.0.1

#

The configuration of the outpost is pretty simple :

log_level: debug
docker_labels: null
authentik_host: http://server:9000/
docker_network: docker_br-docker
container_image: null
docker_map_ports: true
object_naming_template: ldap
authentik_host_insecure: true
#

Entering in shell in the ldap outpost, I can send requests to the authentik server with success :

/ # wget -S -O- http://server:9000
Connecting to server:9000 (10.50.0.6:9000)
  HTTP/1.1 302 Found
  Content-Length: 0
  Content-Type: text/html; charset=utf-8
  Date: Fri, 14 Jul 2023 12:36:31 GMT
  Location: /flows/-/default/authentication/?next=/
  HTTP/1.1 302 Found
  Content-Length: 0
  Content-Type: text/html; charset=utf-8
  Date: Fri, 14 Jul 2023 12:36:31 GMT
  Location: /if/flow/welcome/?next=%2F
  [...]
#

From the authentik server, I can also talk to the ldap outpost. Well it doesn't work because of the authentication problem but network is OK.

root@66c03aae7075:/# ldapsearch -H ldap://ldap:3389 -b "" -s base "(objectclass=*)" -x
ldap_bind: Insufficient access (50)
wary siren
#

But somehow the authentication is partially working :

ldapsearch -H ldap://10.50.12.7 -D cn=ldapservice,ou=users,DC=ldap,DC=goauthentik,DC=io -w wrong_password -b DC=ldap,DC=goauthentik,DC=io "(objectClass=user)"
ldap_bind: Invalid credentials (49)

2023-07-14T14:56:11+0200 ldap 66c03aae7075[750]: {"action": "login_failed", "auth_via": "unauthenticated", "client_ip": "10.50.0.1", "context": {"http_request": {"args": {"goauthentik.io/outpost/ldap": "true"}, "method": "POST", "path": "/api/v3/flows/executor/welcome/"}, "password": "********************", "stage": {"app": "authentik_stages_identification", "model_name": "identificationstage", "name": "default-authentication-identification", "pk": "b3c93a1a74244b599b15040ebffd89f1"}, "username": "ldapservice"}, "event": "Created Event", "host": "server:9000", "level": "info", "logger": "authentik.events.models", "pid": 159416, "request_id": "fdd442e44e584fe29da091239674e85a", "timestamp": "2023-07-14T12:56:11.027704", "user": {"email": "", "pk": 2, "username": "AnonymousUser"}}
# 
ldapsearch -H ldap://10.50.12.7 -D cn=ldapservice,ou=users,DC=ldap,DC=goauthentik,DC=io -w good_password -b DC=ldap,DC=goauthentik,DC=io "(objectClass=user)"
ldap_bind: Invalid credentials (49)

2023-07-14T14:59:16+0200 ldap 139ce24978c2[750]: {"bindDN":"cn=ldapservice,ou=users,dc=ldap,dc=goauthentik,dc=io","client":"10.50.0.1","component":"ak-stage-identification","event":"Got challenge","flow":"welcome","level":"debug","requestId":"d24636be-39ad-45ce-a3d0-f1ddcd27604a","timestamp":"2023-07-14T12:59:16Z","type":"native"}
2023-07-14T14:59:16+0200 ldap 66c03aae7075[750]: {"auth_via": "unauthenticated", "backend": "authentik.core.auth.InbuiltBackend", "event": "Successful authentication", "host": "server:9000", "level": "info", "logger": "authentik.stages.password.stage", "pid": 159416, "request_id": "972204cdecc445d99e1800556df95de0", "timestamp": "2023-07-14T12:59:16.401536", "user": "ldapservice"}
#

Wrong password : login_failed
Good password : Successful authentication
But same result : Invalid credentials (49)

wary siren
#

I dumped with tcpdump a GET/POST transaction if it could help :

GET /api/v3/flows/executor/ldap-authentication-flow/?query=goauthentik.io%252Foutpost%252Fldap%3Dtrue HTTP/1.1
Host: server:9000
User-Agent: goauthentik.io/outpost/2023.5.5
Accept: application/json
Content-Type: application/json
Referer: http://server:9000/api/v3/flows/executor/ldap-authentication-flow/?query=goauthentik.io%252Foutpost%252Fldap%3Dtrue
Sentry-Trace: c9baca41c43b4d3e97c485102b2d2cb6-fb3200847cd085db-0
X-Authentik-Outpost-Token: Y2kOKDg6Db8Lxdt5uhLMsovuZC1URjY3TQ3B5HaZPMgCH16AruRNIgjq0adz
X-Authentik-Remote-Ip: 10.50.0.1
Accept-Encoding: gzip
# 
HTTP/1.1 200 OK
Allow: GET, POST, HEAD, OPTIONS
Content-Encoding: gzip
Content-Type: application/json
Date: Fri, 14 Jul 2023 13:33:04 GMT
Referrer-Policy: same-origin
Set-Cookie: authentik_session=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzaWQiOiIxbWh5ZGtnY3o1ZGNpMXB6MnJidDNsanl0eGtta2hjdCIsImlzcyI6ImF1dGhlbnRpayIsInN1YiI6ImFub255bW91cyIsImF1dGhlbnRpY2F0ZWQiOmZhbHNlLCJhY3IiOiJnb2F1dGhlbnRpay5pby9jb3JlL2RlZmF1bHQifQ.DLgIIheSh3YivtTTRp7dW4JsY1tf_r9ORVvcti8dyNA; Domain=mydomain.com; HttpOnly; Path=/; SameSite=Lax
Vary: Accept-Encoding
Vary: Cookie
X-Authentik-Id: 6abcccabe8264f02b0004e3f62d1a8fd
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-Powered-By: authentik
Content-Length: 244

{"type": "native", "flow_info": {"title": "LDAP Authentication Flow", "background": "/static/dist/assets/images/flow_background.jpg", "cancel_url": "/flows/-/cancel/", "layout": "stacked"}, "component": "ak-stage-identification", "user_fields": ["username"], "password_fields": false, "primary_action": "Log in", "sources": [], "show_source_labels": false}
# 
POST /api/v3/flows/executor/ldap-authentication-flow/?query=goauthentik.io%252Foutpost%252Fldap%3Dtrue HTTP/1.1
Host: server:9000
User-Agent: goauthentik.io/outpost/2023.5.5
Content-Length: 100
Accept: application/json
Content-Type: application/json
Sentry-Trace: c9baca41c43b4d3e97c485102b2d2cb6-0ea967b09bf97aca-0
X-Authentik-Outpost-Token: Y2kOKDg6Db8Lxdt5uhLMsovuZC1URjY3TQ3B5HaZPMgCH16AruRNIgjq0adz
X-Authentik-Remote-Ip: 10.50.0.1
Accept-Encoding: gzip

{"component":"ak-stage-identification","password":"SomePassword","uid_field":"ldapservice"}
# 
HTTP/1.1 302 Found
Allow: GET, POST, HEAD, OPTIONS
Content-Encoding: gzip
Content-Type: text/html; charset=utf-8
Date: Fri, 14 Jul 2023 13:33:05 GMT
Location: /api/v3/flows/executor/ldap-authentication-flow/?query=goauthentik.io%252Foutpost%252Fldap%3Dtrue
Referrer-Policy: same-origin
Set-Cookie: authentik_session=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzaWQiOiJpcWFmN3NrNzI4aGt3eHJveGs5MXl5YmJ2dTI3bzVlcCIsImlzcyI6ImF1dGhlbnRpayIsInN1YiI6ImFub255bW91cyIsImF1dGhlbnRpY2F0ZWQiOmZhbHNlLCJhY3IiOiJnb2F1dGhlbnRpay5pby9jb3JlL2RlZmF1bHQifQ.dpdM_spq9u12Mg4M5A5P0AEyrcTcXjCBP-gx_Wlxa0I; Domain=mydomain.com; HttpOnly; Path=/; SameSite=Lax
Vary: Accept-Encoding
Vary: Cookie
X-Authentik-Id: 591d6517b9d74ada8cfad75a4a380de8
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-Powered-By: authentik
Content-Length: 23
wary siren
#

Finally, got it working !

broken pewter
#

Glad you figured it out and interesting how that's the solution

wary siren
#

Thanks @broken pewter for your help

broken pewter
#

You did it all by yourself lol, so if anything congratz on sticking to figuring out the problem.

obsidian mural
#

@wary siren ... did you use it as homelab? or any plan to use it on production ?

wary siren
#

HomeProduction 😅