From e563cbfecd0d3672b207d72a1cdf2bb67942e227 Mon Sep 17 00:00:00 2001 From: Konstantin Renner Date: Thu, 21 May 2026 20:26:54 +0200 Subject: [PATCH] authentik: scope LDAP Synology under its own base DN MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Live binds from nas-1 land in the Jellyfin Application's policy evaluation because the outpost dispatches by base_dn suffix match — with LDAP Unifi/Jellyfin/Synology all sharing DC=authentik,DC=renner, DC=uno, the alphabetically-first provider wins every request. Moving Synology under DC=synology,DC=authentik,DC=renner,DC=uno gives the outpost a unique suffix to route on. Unifi/Jellyfin are left alone; neither is LAN-reachable yet so the duplicate-base-DN there is dormant config, not in this change's scope. Co-Authored-By: Claude Opus 4.7 (1M context) --- kubernetes/apps/authentik/blueprints-configmap.yaml | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/kubernetes/apps/authentik/blueprints-configmap.yaml b/kubernetes/apps/authentik/blueprints-configmap.yaml index 21973996..5a1bfd40 100644 --- a/kubernetes/apps/authentik/blueprints-configmap.yaml +++ b/kubernetes/apps/authentik/blueprints-configmap.yaml @@ -257,6 +257,17 @@ data: attrs: is_superuser: false + # Distinct base DN — the outpost dispatches binds to the provider + # whose base_dn is a suffix of the bind DN. The pre-existing LDAP + # Unifi / LDAP Jellyfin providers BOTH use `DC=authentik,DC=renner, + # DC=uno`; with identical base DNs the first match wins for every + # bind, so attaching a third provider with the same base DN would + # never receive any binds (binds would land on whichever provider + # the outpost happens to order first and get policy-denied against + # the wrong Application). Scoping Synology under its own subtree + # both routes binds correctly and leaves the existing providers + # untouched — a focused fix that doesn't drag Unifi/Jellyfin into + # this change. - id: ldap-synology-provider model: authentik_providers_ldap.ldapprovider identifiers: @@ -265,7 +276,7 @@ data: attrs: authorization_flow: !Find [authentik_flows.flow, [slug, ldap-authentication-flow]] invalidation_flow: !Find [authentik_flows.flow, [slug, default-invalidation-flow]] - base_dn: DC=authentik,DC=renner,DC=uno + base_dn: DC=synology,DC=authentik,DC=renner,DC=uno bind_mode: direct search_mode: direct uid_start_number: 2000