synology ldap - failed to connect to ldap server

[badsmoke]

Describe your question/
hey folks

i am trying to connect a synology to the ldap outpost.

unfortunately the synology tries to find out the base DN automatically, there is problem.

you can not enter the entry manually, as soon as you click it tries to find the base DN.

do you have to enable "anonymous" search in the authentik ldap outpost? is that possible?

i have tested it with an openldap container, so the automatic query works

Relevant infos
synology version 7.1.1

Screenshots

Logs

authentik_ldap_1 | timestamp="2022-12-06T08:40:02Z" level=warning event="No provider found for request" bindDN= client=10.1.0.181 request=bind requestId=f16e9200-8ab7-4151-a42f-1953c3ed369e authentik_ldap_1 | timestamp="2022-12-06T08:40:02Z" level=info event="Bind request" bindDN= client=10.1.0.181 requestId=f16e9200-8ab7-4151-a42f-1953c3ed369e took-ms=0

Version and Deployment (please complete the following information):

• authentik version: 2022.11.3
• Deployment: docker-compose

Additional context
Add any other context about the problem here.

[romancin]

Same problem here :( Did you find a solution?

[EmilyNerdGirl]

If I paste in the Base DN and immediately hit next, I can get to the next screen, but it complains about the uid and then the gid fields :(

[badsmoke]

no have unfortunately also still no solution

[cookie-monster-bit]

Same issue. I thought it was my setup. Spent a day trying to troubleshot and even spun up another authentik instance in docker for a fresh setup still a no go. Authelia has no issues with Synology so I wonder what is causing authentik to have problems.

[pelicangris]

Hi, i have the same issue and indeed pasting the Base DN and quickly hitting next allows to go a step further.
It then fails with this (apologies, this is in French):

The LDAP provider in Authentik only maps the users to ObjectClass=user, inetOrgPerson, organisationalPerson and goauthentik/ldap/user where Synology DSM seems to expect ObjectClass=posixAccount.

I have tried to amend the filter that Synology DSM is trying to use but this seems to get ignored.
Would there be a way to add posixAccount as an objectClass through a custom mapping in Authentik?

[EmilyNerdGirl]

I was thinking about this last night after I got ssh public keys working with LDAP from this issue, so it may be possible; #2145

[EmilyNerdGirl]

However I think we're running into this issues; #2573

[EmilyNerdGirl]

https://www.synology.com/en-ro/dsm/7.1/software_spec/dsm

Synology LDAP client uses objectClass posixAccount for users and objectClass posixGroup for groups by default. If your LDAP server does not support posixAccount or posixGroup, please set up a profile to map the attributes correctly:
User name: posixAccount - uid
User ID: posixAccount - uidNumber
Group name: posixGroup - cn
Group ID: posixGroup - gidNumber

[roche-quentin]

Hello, I'm building a fix for Synology LDAP. It seems to work.

Password verification does not work yet. I will try to set Oauth2 for login instead of LDAP.

https://github.com/roche-quentin/authentik

[EmilyNerdGirl]

Has anyone been able to get it to work in 2023.3.0 ? I get further (so no errors to get to the wizard now, thank you!) but it's failing the Check Profile for (objectClass=posixAccount) uid/uidNumber . I see the same thing when I use Apache Directory Studio, I get results for (objectClass=user) but not (objectClass=posixAccount). Thanks!

[romancin]

Finally, it works correctly. You have to configure a custom mapping for attributes like this one:

[EmilyNerdGirl]

Thank You!!! That worked!