Release 2026.26 - #394
Merged
Merged
Release 2026.26#394
Conversation
unpkg's unpinned @babel/standalone now resolves to v8, which defaults JSX to the automatic runtime and emits an ESM import. The classic UMD admin page then crashes with 'Cannot use import statement outside a module' when Babel injects the compiled script. Pin Babel to 7.26.4 and React/ReactDOM to 18.3.1 for deterministic, working output.
fix(admin): pin Babel & React CDN versions to fix /admin crash in prod
The migrated LDAP cluster no longer permits anonymous searches, so the pre-auth admin-group membership check fails with InsufficientAccessRights. Add optional LDAP_BIND_DN / LDAP_BIND_PASSWORD service-account credentials (matching what SSSD uses) and bind with them for the group search when set. Falls back to anonymous search when unset, so behaviour is unchanged for existing deployments. The ldapsearch CLI fallback also uses the bind creds. Also corrects the example port (636 -> 6636) and user OU (people -> users) in the env-var docblock to match the new directory layout.
fix(admin): authenticated LDAP search for group membership
The admin group membership check only searched (memberUid=<user>), which fails for groupOfNames/groupOfUniqueNames directories that list members via 'member'/'uniqueMember' with the full DN (e.g. authentik's 'member: cn=<user>,ou=users,...'). Admin logins failed with NOT_IN_GROUP even for valid admins. buildMembershipFilter now ORs memberUid, member and uniqueMember with both uid= and cn= DN forms derived from LDAP_USER_BASE_DN, while still honoring an explicit LDAP_GROUP_MEMBER_ATTR override. Applied to both the in-process search and the ldapsearch CLI fallback. Docs updated to use the correct ou=users / ou=groups DNs.
fix(admin-auth): match all LDAP group membership schemes
The password bind hard-coded the user DN as uid=<username>,<base>, which fails on directories that use cn as the user RDN (e.g. authentik, where the entry is cn=aabrol,ou=users,...). The bind returned INSUFFICIENT_ACCESS. Add LDAP_USER_RDN_ATTR (default uid) and build the bind DN as <rdn>=<username>,<userBaseDn>. Set LDAP_USER_RDN_ATTR=cn for authentik. Docs updated.
fix(admin-auth): configurable user RDN attribute for LDAP bind
The CLI fallback existed to work around false negatives from anonymous in-process searches. We now use an authenticated service-account search that works reliably, so the fallback is dead weight: it ran on every legitimate non-member, added latency, and passed the bind password as a command-line argument (visible in process listings). Removes ldapSearchCli and the now-unused execFile/promisify imports.
refactor(admin-auth): remove redundant ldapsearch CLI fallback
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request introduces several improvements to LDAP admin authentication, enhances compatibility with various directory setups, and updates the documentation and dependencies to reflect these changes. The main focus is on supporting service-account (bind DN) group membership checks, improving group membership detection for different LDAP schemas, and clarifying configuration options for administrators.
LDAP Admin Authentication Improvements:
LDAP_BIND_DN,LDAP_BIND_PASSWORD) for group membership searches, improving compatibility with directories that disallow anonymous searches. The group membership check now uses a service bind if configured, otherwise falls back to anonymous search. [1] [2]memberUid,member,uniqueMemberwith bothuidandcnDNs), increasing compatibility with different directory structures. [1] [2]LDAP_USER_RDN_ATTR, defaulting to"uid") to support directories like authentik that use"cn"instead of"uid"for user DNs. [1] [2]Documentation Updates:
docs/ADMIN_DASHBOARD.mdto document new environment variables, clarify usage of user/group DNs, and improve table formatting for readability. [1] [2] [3]Dependency and Version Updates:
server/templates/admin.jsfor improved stability and compatibility with the classic UMD build.1.4.41inmobile-config.jsand updatedpublic/buildInfo.jsonto reflect the new build. [1] [2]