From 90906e23b691ae78ac0f4e07d8e60fa0d7b25c28 Mon Sep 17 00:00:00 2001 From: Konstantin Renner Date: Thu, 21 May 2026 20:37:45 +0200 Subject: [PATCH] authentik: move LDAP Synology base DN to sibling subtree DC=synology,DC=authentik,DC=renner,DC=uno is a child of the existing Unifi/Jellyfin base; the outpost's HasSuffixNoCase dispatch matches on first iteration without longest-match preference, so binds still landed on Jellyfin's policy. Moving Synology to DC=synology,DC=renner, DC=uno makes it a sibling subtree the others' suffix check can't claim. Co-Authored-By: Claude Opus 4.7 (1M context) --- .../apps/authentik/blueprints-configmap.yaml | 25 ++++++++++--------- 1 file changed, 13 insertions(+), 12 deletions(-) diff --git a/kubernetes/apps/authentik/blueprints-configmap.yaml b/kubernetes/apps/authentik/blueprints-configmap.yaml index 5a1bfd40..b07cad07 100644 --- a/kubernetes/apps/authentik/blueprints-configmap.yaml +++ b/kubernetes/apps/authentik/blueprints-configmap.yaml @@ -257,17 +257,18 @@ data: attrs: is_superuser: false - # Distinct base DN — the outpost dispatches binds to the provider - # whose base_dn is a suffix of the bind DN. The pre-existing LDAP - # Unifi / LDAP Jellyfin providers BOTH use `DC=authentik,DC=renner, - # DC=uno`; with identical base DNs the first match wins for every - # bind, so attaching a third provider with the same base DN would - # never receive any binds (binds would land on whichever provider - # the outpost happens to order first and get policy-denied against - # the wrong Application). Scoping Synology under its own subtree - # both routes binds correctly and leaves the existing providers - # untouched — a focused fix that doesn't drag Unifi/Jellyfin into - # this change. + # SIBLING base DN, not a child of DC=authentik,DC=renner,DC=uno. + # The LDAP outpost dispatches with HasSuffixNoCase(bindDN, baseDN) + # and returns on the first iterated provider whose base_dn is a + # suffix — no longest-match preference. The pre-existing LDAP + # Unifi / LDAP Jellyfin providers both use DC=authentik,DC=renner, + # DC=uno and have lower provider IDs, so anything under that + # subtree (including a would-be child like DC=synology,DC=authentik, + # DC=renner,DC=uno) gets routed to whichever of those iterates + # first (Jellyfin in this cluster) and fails Jellyfin's policy. + # Using a sibling subtree under DC=renner,DC=uno avoids the + # collision entirely. Unifi/Jellyfin are left alone — their + # duplicate-base-DN is dormant config that does not affect Synology. - id: ldap-synology-provider model: authentik_providers_ldap.ldapprovider identifiers: @@ -276,7 +277,7 @@ data: attrs: authorization_flow: !Find [authentik_flows.flow, [slug, ldap-authentication-flow]] invalidation_flow: !Find [authentik_flows.flow, [slug, default-invalidation-flow]] - base_dn: DC=synology,DC=authentik,DC=renner,DC=uno + base_dn: DC=synology,DC=renner,DC=uno bind_mode: direct search_mode: direct uid_start_number: 2000