The following placeholders will be used:
svc_authentikis the name of the bind account.
freeipa.companyis the Name of the domain.
ipa1.freeipa.companyis the Name of the FreeIPA server.
Log into FreeIPA.
Create a user in FreeIPA, matching your naming scheme. Provide a strong password, example generation methods:
pwgen 64 1or
openssl rand -base64 36. Once done click
Add and Edit.
In the user management screen, select the Roles tab.
Add a role that has privileges to change user passwords, the default
User Administratorsrole is sufficient. This is needed to support password resets from within authentik.
By default, if an administrator account resets a user's password in FreeIPA the user's password expires after the first use and must be reset again. This is a security feature to ensure password complexity and history policies are enforced. To bypass this feature for a more seamless experience, you can make the following modification on each of your FreeIPA servers:
$ ldapmodify -x -D "cn=Directory Manager" -W -h ipa1.freeipa.company -p 389
In authentik, create a new LDAP Source in Resources -> Sources.
Use these settings:
You can specify multiple servers by separating URIs with a comma, like
When using a DNS entry with multiple Records, authentik will select a random entry when first connecting.
Bind Password: The password you've given the user above
Property mappings: Control/Command-select all Mappings which start with "authentik default LDAP" and "authentik default OpenLDAP"
Group property mappings: Select "authentik default OpenLDAP Mapping: cn"
Group: If selected, all synchronized groups will be given this group as a parent.
Addition User/Group DN:
Addition Group DN:
User object filter:
Group object filter:
Group membership field:
Object uniqueness field:
After you save the source, you can kick off a synchronization by navigating to the source, clicking on the "Sync" tab, and clicking the "Run sync again" button.
Lastly, verify that the "User database + LDAP password" backend is selected in the "Password Stage" under Flows -> Stages.