LDAP with Authentik: user.query returns empty list and middleware crashes with pydantic ValidationError on TrueNAS SCALE 25.04.2.6

TrueNAS General
1

TrueNAS SCALE version: 25.04.2.6
LDAP Provider: Authentik (self-hosted)

Issue:

  • LDAP status shows HEALTHY
  • getent passwd correctly shows LDAP users
  • user.query returns empty list
  • Attempting to set ACL with LDAP user fails with “account does not exist”
  • Calling user.query with search_dscache causes pydantic ValidationError

Steps to reproduce:

  1. Configure LDAP with Authentik as provider
  2. Enable LDAP - status shows HEALTHY
  3. Run: sudo midclt call user.query ‘[[“username”, “=”, “*”]]’
    Result:
  4. Run: sudo midclt call user.query ‘’ ‘{“extra”: {“search_dscache”: true}}’
    Result: pydantic ValidationError crash

Error:
pydantic_core._pydantic_core.ValidationError: 3 validation errors for UserQueryResult
result.list[UserQueryResultItem].62.home
String should have at least 1 character [type=string_too_short]

Workaround: none found

2

As you’ve discovered, running LDAP directory services on TrueNAS as both a host and client of said services is a bad idea. Directory services should be off-box, and TrueNAS should have emergency local accounts in case the directory is unavailable.

If you have config backups, from before configuring Authentik, you can reinstall TrueNAS, and then apply the most recent saved config to get back to your pre-Authentik working state. Otherwise, you’re stuck with reinstalling and keying everything back in by hand.

3

Hi,

First of all, thanks for your reply. Disabling LDAP on TrueNAS shows me local accounts. My goal was to use Authentik accounts to centralize logins to the shares. That’s why I configured LDAP with Authentik, but when I go to the user list, I don’t see them, but I do see the Authentik groups correctly.

4

I believe there was another post in the past that attempted the same and he came to the conclusion that it wasn’t possible to do it with truenas and authentik…

Eidt:

there it’s stated that ldap ui authentification is an enterprise only feature…

5

Really sad, but I wonder why they allow the configuration and then can’t use it, an error comes back to me so I think it’s a user bug, because I see the groupS normally

:face_holding_back_tears:

6

I may be also wrong, because the other user attempted to allow ldap users to access the truenas webui, which i believe is the enterprise only feature, not the normal smb/nfs authentification

7

I just have to use LDAP users for SMB/NFS shares

8

LDAP users won’t work for SMB. You won’t have a supported authentication mechanism (kerberos) with plain LDAP setup. Typically you’d want AD to make this work properly.

Note: this is also true for NFS if you want real authentication.

1 Like