How to map a Authentik property to LDAP?

[ProjectPatatoe]

How can I map an Authentik property to LDAP?
Example:

• Authentik's first_name and on LDAP it would get givenName
• Authentik's avatar retrives through an expression and returns a base64 version of the url as jpegPhoto
• ... and so on

[nerddotdad]

@ProjectPatatoe I think we're battling some of the same monsters. So I manged to get the fields I wanted to come through from ldap but did a decent amount of trial and error using the ldapsearch tool on command line. I'm currently held up trying to get the right content for the jpeg for avatars in jellyfin but managed to get to the point where it at least reads the avatar tag from the ldap plugin and creates a jpeg file with the contents of that field. So when I cat the new profile.jpg from the user in jellyfin it has the base64 from authentik in it. Unfortuntely that isn't the content jellyfin wants apparently so I'm hoping I can get some answers from the ldap plugin authors as to what exactly they expect in that file jellyfin/jellyfin-plugin-ldapauth#154

[sskokorin]

Hi! Sorry for maybe going off topic. If I understand correctly, you were able to get a custom attribute from Authentik LDAP using ldapsearch ?
How did you do it? I struggled with this, but it didn't work.

[nerddotdad]

It's been a while since I've tinkered with it but I think what I did was use an leap browser to visualize the structure and then made a query.

[funar]

I just fell down this rabbit hole and found this issue. Is this possible?

[l-e-e-o]

Providing an LDAP-like jpegPhoto attribute from authentik does not seem to be possible currently (#10055 (reply in thread)).

However, it turns out this is not even necessary. I dug through the code of the LDAP plugin and found that it uses this TryDetermineAttributeFormat function which not only supports base64 but also URI. As I had avatar support in authentik already set up as described in #6824 with my own modifications (#6824 (reply in thread)), I can just use avatar-url as the LDAP Profile Image Attribute setting in the Jellyfin LDAP plugin and this just works.

[charredchar]

I've been working on this same thing. (I also ended up posting in #6824 as well, thanks a ton for the modification of the script)
You hit the nail on the head with your other post, when it comes to jpegPhoto it should be output as binary from the LDAP provider and Authentik doesn't do this.
While the avatar-url solution works fine for something like Jellyfin, as the LDAP plugin there is far more flexible, ones that are more strict and less configurable (such as Nextcloud) won't accept it.
I'm not sure what can be done about this... But I wanted to add this note for others that might come later.

[ProjectPatatoe]

I'm pretty confused as to what exactly the LDAP standard is for jpegPhoto. Is it base64? binary? url? (doubt it). only jpeg? what about png or bmp or gif?

[ProjectPatatoe]

Active Directory jpegPhoto

Used to store one or more images of a person using the JPEG File Interchange Format [JFIF].

Active Directory photo

An object encoded in G3 fax as explained in recommendation T.4, with an ASN.1 wrapper to make it compatible with an X.400 BodyPart as defined in X.420.

Not exactly LDAP but they're supposed to be compatible. Doesn't tell me if its binary or base64 but I'm assuming binary I guess?

[l-e-e-o]

To me it also looks like this is just binary data. Meaning for now this does not seem to be possible, as we can't store binary data in user attributes and transforming it during the output would require an outbound LDAP mapping which is currently not supported (#2573).