LDAP outpost seemingly not working

[pseudo whale]

I need LDAP integration to set up authentication for calibre-web.

I've followed this entire page (https://docs.goauthentik.io/docs/providers/ldap/generic_setup), and it is now telling me that the outpost is up and running. I'm using the default kubernetes integration, and upon querying with kubectl, the outpost's pod is up, and the service is available.

However, when I go to test the outpost by running an ldapsearch command, it fails, telling me that my credentials are valid.

I'm not sure what I'm missing here.

I've created a new account (ldapservice), made a group and assigned it (ldapsearch), and then set it as the LDAP search group within the provider.

I've manually set the ldapservice account's password, but when I try to run the test command (below) it fails, saying ldap_bind: Invalid credentials (49)

Test command:

# in other terminal, still open
kubectl port-forward services/ak-outpost-ldap 3389:389

# test command
ldapsearch \
  -x \
  -H ldap://localhost:3389 \
  -D 'cn=ldapservice,ou=users,DC=ldap,DC=goauthentik,DC=io' \
  -w '<ldapuserpassword>' \
  -b 'DC=ldap,DC=goauthentik,DC=io' \
  '(objectClass=user)'

[rustic grail]

i've had really bad time working with LDAP. its unusable for me sadly as after 2 or 3 outposts it just wont connect anymore. you have to constantly delete and recreate stuff you already made to make it working again.. and it was just super unstable. i would suggest trying to migrate yourself over to using OIDC. if you don't use LDAP at all, Authentik is hands down the absolute best thing ever. but if you REALLY need LDAP, then i'd say you need to delete every LDAP connection and just keep one connection to an openLDAP server in PROXY mode

the OpenLDAP proxy will handle all LDAP connections to apps and all that and its really great

then it'll sync every hour or whenever you want to your authentik database provided it just happens to be working when it tries

that should work perfect and thats how our setup was until we migrated away from LDAP all together

i hope that helps if you're forced to stick with LDAP

[pseudo whale]

tbh this could all be avoided if calibre-web allowed more than github and gitlab for oauth. like that library it's using for those is capable of doing generic oauth for calibre, but the maintainder didn't want to enable generic oauth support because "two options is already enough for most people".

the only other options are local users (don't want to mange) and LDAP (has proven to be a pain)

it might be easier to fork calibre-web and enable generic oauth support rather than try to figure out what's not working with LDAP lol

[rustic grail]

Yeah, that's why I switched to using I think kavita or something else easier to use and just as full featured

[unique grove]

@rustic grail Could you further explain your OpenLDAP proxy solution? I have to stick with LDAP since we use it to login at servers.