"Insufficient access" for service accounts if an application has Policy/User/Group bindings

[Ma27]

"Insufficient access" for service accounts if an application has Policy/User/Group bindings

[BeryJu]

The definitely sounds like a bug, after successfully binding the outpost uses the /core/applications/{slug}/check_access/ API with the session that was just authenticated by the flow and thus it should correctly check access to the correct application. Although one thing that could also cause this behaviour is if both of your LDAP providers have the same base DN, as the outpost will use them to determine which application the request belongs to.

[Ma27]

Although one thing that could also cause this behaviour is if both of your LDAP providers have the same base DN, as the outpost will use them to determine which application the request belongs to.

Sorry, should've mentioned that, they do indeed (all the stuff used the same OpenLDAP server before, so I decided to keep the base DN to make it a little easier).

[BeryJu]

Having multiple LDAP providers with the same Base DN is supported, however they can't be in the same outpost

[Ma27]

So I hope I didn't just miss it in the docs somewhere, but I think it might help to display a warning if that is about to be configured, no?

[BeryJu]

There is a note towards the top of https://docs.goauthentik.io/docs/providers/ldap/, but it should definitely also be shown in the admin UI