#Login Redirect for LDAP Authentication

1 messages · Page 1 of 1 (latest)

gritty rover
#

So I've gotten LDAP working within Authentik, groups working to determine access by creating a separate provider with an associated group - Is it possible to pass authentication from Authentik to the service? Right now, I can use the LDAP user credentials with the appropriate access configuration to log in to the target service UI (Syncthing in this case). Is it possible to instead be directed to the Authentik login page that will authenticate with the LDAP credentials and redirect to the service UI logged in as a configured user?

#

I'm using Nginx Proxy Manager as my reverse proxy - I've gotten HTTP basic auth forwarding working so navigating to the service site hits my Authentik instance -> authenticates and redirects to a now logged in service. Is there a way to implement the same user experience using LDAP? If so, how is it configured?

gritty rover
#

Any ideas?

sturdy hamlet
#

trying to understand, so your ldap credentials do not log you into authentik? you have 2 different logins?

sour gyro
gritty rover
#

My understanding at this point is that LDAP is just a user directory, a place to store credentials in this case. What's the typical method for walling off apps that authenticate with LDAP using Authentik? Is this just a double log in scenario (like authenticating against a proxy and then logging in after gaining access) or is there something clever to address this scenario that I'm missing?

sturdy hamlet
#

LDAP is just another method of logging in using another database besides authentiks built in users

#

youll still get the same authentik login screen

#

So for example, my windows server active directory syncs with authentik, so all those users are syned into authentik and when going to an app ill get the authentik login screen and they can use the same username and password from aactive directory, which in this case is used for computer logins and wifi logins.

gritty rover
#

Fair enough. Are your groups defined in AD and does that determine access?

#

I've found my user accounts have access to anything I dont have a group policy applied to, and then I have to limit access with LDAP group filters in-app

sturdy hamlet
#

yea my groups come from my AD, once the groups are synced i have to go into authentik and go to the application and assign the group to it manually each time i create a new app

#

i create tha ad group first, before creating the app so there isnt a random unfinished up on anyones end

gritty rover
# sturdy hamlet yea my groups come from my AD, once the groups are synced i have to go into auth...

Oh its cool that your groups get synced. Okay, so my testing seems to be typical based on how it functions for you as well. Good to know, as this is my first dive into LDAP. What do you do for apps that dont have OIDC support or basic HTTP forwarding? My ldap users atm just navigate to the web service directly. No Authentik login page/auth handoff, just defined in LDAP. Is this the idea or is there an additional component I havent recognized yet?

sturdy hamlet
#

For one app that i host myself i still do it proxied, so if you enter the webpage url ill get hit with authentiks login but its more for hiding and securing the page more than than anything, then they can login in using ldap thats configured inside the hosted app

#

and also for access control so i give only certin people the tile on there dashboard, if someone unauthorized tried to sign in with there authentik login page, theyll get a access denied

gritty rover
#

Gotcha, I appreciate the info!

#

Oh, how do you handle profile pictures w/ LDAP users?

#

I was hoping to pass them through, but i'm not having much luck w/ it

sturdy hamlet
#

Hm I actually haven’t tried that yet, didn’t know I can set pictures lol. what Active Directory are you using?

gritty rover
#

i'm not sure Authentik supports images with LDAP though

sturdy hamlet
#

I’m not sure either lol

#

I don’t think so