LDAP with custom domain | authentik | Page 1

unreal bone Apr 11, 2025, 10:10 AM

#

Hi guys, i'm new here. I would like to setup LDAP outpost for different domains of my customers. I see that the default is DC=goauthentik,DC=io. Is it possible to change and "create" different domains?

zenith stump Apr 11, 2025, 10:11 AM

#

on the ldap provider under protocol settings you can define your desired base

unreal bone Apr 11, 2025, 10:15 AM

#

Ok, i already did this, but how can i "attach" the users under that base? i would like to separate the users so every customer has his base

zenith stump Apr 11, 2025, 11:22 AM

#

if i understand that correct you need to create an ldap provider for each customer with their unique ldap base and connect each provider to the outpost

#

not sure how to limit the users inside that provider to a specific set of users tho

unreal bone Apr 11, 2025, 11:54 AM

#

i'll do an example

#

in jumpcloud, when i configure ldap provider, it generates a base DN: O=something,DC=jumpcloud,DC=com

#

i think that the O is the customer organization on which an application can do a lookup

#

i would like to separate the various customers on my authentik

#

but the problem is that if i use the default config ldap.goauthentik.io i could create groups on which i could insert the customer's users

#

but the domain still remains unique "ldap.goauthentik.io"

#

i don't know if i'm explaining in a clear way, i'd like to configure authentik as a "multi-forest" in Microsoft AD

zenith stump Apr 11, 2025, 1:32 PM

#

i understand the goal. i just have no clue if thats possible the way you currently want it.
i would create a provider for each domain in that forest and then try to figure out how to separate it and play around with ldapsearch to verify.
the base can be provided per provider, but i have no clue on how to set it up the way that only the users of a specific directory is getting populated in the ldap structure

unreal bone Apr 11, 2025, 2:07 PM

#

and for example, have you got any idea for modify the default domain goauthentik.io? can i modify it via docker-compose?

zenith stump Apr 11, 2025, 2:07 PM

#

on the provider

#

im running my own domain just by defining in the provider

unreal bone Apr 11, 2025, 2:26 PM

#

ok, i tried to configure 2 providers with a different domain each one

#

i created 2 ldap search bind user and i gave them the respective permissions on the providers

#

but if i do the ldap search, either find the same authentik's directory

#

do you know a method to separate the 2 "searches"

zenith stump Apr 11, 2025, 2:28 PM

#

have you restricted the application in the bindings?

#

that might be the way

unreal bone Apr 11, 2025, 2:28 PM

#

let me check

zenith stump Apr 11, 2025, 2:30 PM

#

now i want to play around with that aswell. but need some time before im on any pc

unreal bone Apr 11, 2025, 2:30 PM

#

no problem, i did the binding in the application using group

#

with only the ldap search user inside, but i see all the directory 😦

#

i think that i might doing something wrong with the filter, i'm using "'(objectClass=user)'"

zenith stump Apr 11, 2025, 2:37 PM

#

i guess that user has the right to search the whole tree?

#

might need to define that more specific

unreal bone Apr 11, 2025, 2:37 PM

#

maybe, i only gave him the full search permission on the provider

#

should i use some attributes?

zenith stump Apr 11, 2025, 2:38 PM

#

well, the provider is currently offering all users from your authentik

#

goal would be limiting the provider to only return the desired users and groups. so it needs to be somewhere on either application or provider

#

with the full tree right you see all users in the authentik instance

unreal bone Apr 11, 2025, 2:39 PM

#

you're right

zenith stump Apr 11, 2025, 2:39 PM

#

and the other provider is also offering all users

#

just with a different base

unreal bone Apr 11, 2025, 2:39 PM

#

maybe i should create a new path on the directory menu?

zenith stump Apr 11, 2025, 2:39 PM

#

i would highly suggest that to begin with!

#

if you want to separate them, thats a good idea in general

unreal bone Apr 11, 2025, 2:39 PM

#

and what would be the base DN then?

zenith stump Apr 11, 2025, 2:40 PM

#

from the other provider

#

theres also a preview

#

on what it currently is

#

either on application or provider. cant remember

unreal bone Apr 11, 2025, 2:41 PM

#

ok, i'll try. I'm not understanding if i can use a custom directory path insted of the default "users" in the LDAP base DN

zenith stump Apr 11, 2025, 2:44 PM

#

i dont think you can. thats just purely cosmetical as you want them separate in ldap, they should be separated to begin with, no?

unreal bone Apr 11, 2025, 2:47 PM

#

what i'm seeing is that if i have 2 users, let's say Peter and Tom. Peter is part of Corporate A, Tom is part of Corporate B

#

Corporate A has a domain of example.com

#

Corporate B has a domain of example.eu

#

in authentik i have to configure 4 users in theory:

#

Peter
Tom
LDAP-User-Corporate-A
LDAP-User-Corporate-B

zenith stump Apr 11, 2025, 2:48 PM

#

yes, we are on the same page

unreal bone Apr 11, 2025, 2:49 PM

#

oh ok

zenith stump Apr 11, 2025, 2:49 PM

#

but both service accounts are currently seeing peter and tom within their domain

unreal bone Apr 11, 2025, 2:49 PM

#

not really

#

if i do a LDAP search with LDAP-User-Corporate-A, the result is Peter.ldap.example.com and Tom.ldap.example.com

zenith stump Apr 11, 2025, 2:50 PM

#

yes

unreal bone Apr 11, 2025, 2:51 PM

#

if i do a LDAP search with LDAP-User-Corporate-B, the result is Peter.ldap.example.eu and Tom.ldap.example.eu

zenith stump Apr 11, 2025, 2:51 PM

#

the other returns both with eu

unreal bone Apr 11, 2025, 2:51 PM

#

yeah

#

that's the problem

zenith stump Apr 11, 2025, 2:51 PM

#

ye i know

unreal bone Apr 11, 2025, 2:51 PM

#

so you think that i can't separate "logically" the users?

zenith stump Apr 11, 2025, 2:51 PM

#

thats what i want to find out aswell ^^

#

look into the application binding and provider permissions

#

theres got to be something to limit it somehow

unreal bone Apr 11, 2025, 2:53 PM

#

ok, i will continue the investigation

#

thanks for now!

zenith stump Apr 11, 2025, 2:57 PM

#

text if you find something noteworthy. ill be on in about 2-3 hrs

unreal bone Apr 11, 2025, 4:26 PM

#

No luck 😦

#

I tried some other configurations but i have the same result

zenith stump Apr 11, 2025, 6:22 PM

#

didnt find anything aswell. you might need to use different brands

unreal bone Apr 11, 2025, 6:50 PM

#

i did some other tests

#

if i leave the default base DN, eg. DC=ldap,DC=example,DC=com, with the command ldapsearch i'm able to "restrict" the -b option with the desired user group

#

so it finds only the group i want restrict for the search

#

but when i put the complete base DN that i found in Authentik as base DN of the provider, i get "ldap_bind: Insufficient access (50)"

#LDAP with custom domain