mirror of
https://github.com/lldap/lldap.git
synced 2026-04-25 08:15:52 +03:00
[GH-ISSUE #1125] [BUG]Jellyfin LDAP Plugin Change Password ISSUE #399
Labels
No labels
backend
blocked
bug
cleanup
dependencies
docker
documentation
duplicate
enhancement
enhancement
frontend
github_actions
good first issue
help wanted
help wanted
integration
invalid
ldap
pull-request
question
rust
rust
tests
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/lldap-lldap#399
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @taiwan-king on GitHub (Mar 11, 2025).
Original GitHub issue: https://github.com/lldap/lldap/issues/1125
#620
Sorry,
I expected that when the user changes the password, the account password in LLDAP would also be changed.
However, I found that even if the user changes the password, it only updates the password in the Jellyfin local database, not the LLDAP database.
If SSO is enabled, the same user can log in in two ways: one with the Jellyfin local password and the other with the SSO password.
I'm not sure if this is the result you were expecting.
If it is, please feel free to close the case again.
Thank you!
@nitnelave commented on GitHub (Mar 11, 2025):
Hi!
How did you configure jellyfin? Can you turn on verbose logging in LLDAP and post the logs?
@taiwan-king commented on GitHub (Mar 11, 2025):
I am using Jellyfin's built-in LDAP authentication plugin.
Here are the related settings:
Additionally, I checked the author of the LDAP authentication plugin,
and it seems to be designed to only read LDAP settings without making modifications.
That's why there is a 'Password Reset URL' setting.
However, this setting doesn't seem to work now—there is no popup window or redirect.
The main issue is that your documentation mentions that changes can be made,
but following the settings, I found that it only changes the user password in Jellyfin's database,
not in the LLDAP database.
My user password provider is set to this LDAP plugin.
@nitnelave commented on GitHub (Mar 11, 2025):
Thanks for the plugin configuration, it seems alright.
Can you provide the LLDAP verbose logs as well, during an attempt to change a password with jellyfin?
@taiwan-king commented on GitHub (Mar 11, 2025):
2025-03-11T08:33:47.125949668+00:00 WARN │ ┕━ 🚧 [warn]: Ignoring unknown user attribute "objectcategory" in filter.\n
To disable this warning, add it to "ignored_user_attributes" in the config
@taiwan-king commented on GitHub (Mar 11, 2025):
Sorry, I think I understand now.
Since I’m using DuoAuthProxy, changing the password also requires 2FA.
But Duo has a free 10-user limit.
Therefore, I don’t provide 2FA to regular users,
which might be the reason why regular users can only change their local Jellyfin password.
@nitnelave commented on GitHub (Mar 11, 2025):
Can you enable the verbose logging in LLDAP and post the full logs? It's more like pages of output, not a single line.
Where does duo proxy come in? Does it sit between jellyfin and LLDAP?
@taiwan-king commented on GitHub (Mar 11, 2025):
Yes.
DuoAuthProxy sends the authentication to Duo for 2FA, and then forwards it to LLDAP.
Since I’m using DOZZLE to view, I’m not very clear on how to post the logs,
2025-03-11T08:41:14.976733695+00:00 ERROR 🚨 [error]: [LDAP] Service Error: while handling incoming messages: while receiving LDAP op: Connection reset by peer (os error 104)
This log is likely where the authentication is sent to Duo, so it's getting stuck at 2FA.
so I only picked the ones I don’t understand.
So far, the functionality seems normal,
and I’m pretty sure the issue occurs in DuoAuthProxy.
@taiwan-king commented on GitHub (Mar 11, 2025):
I can provide you with the documentation for integrating with DuoAuthProxy,
and you can decide whether to update the documentation.
However, I found it online, so it's not original.
If you want, I can email it to you.
@nitnelave commented on GitHub (Mar 11, 2025):
Do you think you can make a PR adding an example config for duo auth proxy?
@taiwan-king commented on GitHub (Mar 11, 2025):
Haha Sorry, if you're willing to teach me how to create a PR, I'll paste the content again. Thanks!
@nitnelave commented on GitHub (Mar 11, 2025):
If you don't know git, the best way is probably this https://dev.to/lukegarrigan/the-simplest-way-to-make-a-pull-request-2h61
@martadinata666 commented on GitHub (Mar 11, 2025):
I can confirm that password changing working as Jellyfin+LLDAP only combo, so the third party "duo" in this case somehow interfere, either failed request to LLDAP, or some other reason.
Notice the line "Successfully reset password for ddyms" that request come from jellyfin change password request
@taiwan-king commented on GitHub (Mar 11, 2025):
finished.
@taiwan-king commented on GitHub (Mar 11, 2025):
I have tested it, and changing the LLDAP user password works correctly through Duo 2FA. However, after thinking about it, it doesn’t really make a difference because the issue still exists in reverse—changing the password in LLDAP won’t sync to Jellyfin.
If integrated with Duo, changing passwords also requires 2FA. However, since Duo is a paid service, I haven’t created users for regular users in Duo, so they can't perform 2FA via their phones. DuoAuthProxy directs all traffic to Duo first, which means only users that exist in Duo can use 2FA to change passwords, while regular users cannot use 2FA for this process.
@martadinata666 commented on GitHub (Mar 11, 2025):
Changing password in LLDAP will "change" the password for jellyfin, "change" maybe not the correct term, "Jellyfin should read password from LLDAP.", the problem is why your jellyfin is somehow does not read password from LLDAP when in theory Duo(proxy-ing LLDAP) should read password from LLDAP.
@taiwan-king commented on GitHub (Mar 11, 2025):
Yes, I just tested it, and that's correct.
Sorry, my wording was problematic.
But this applies to users who can authenticate through Duo 2FA.
For users who cannot authenticate through Duo 2FA, password reads or modifications will not be synchronized.
@martadinata666 commented on GitHub (Mar 11, 2025):
I'm rereading your first message. Yes, it's expected behaviour. As far as I can tell, usually, this is because the user was created before the LDAP setup it uses jellyfin-auth rather than LDAP connection.
You can check the user authentication method at jellyfin user management, users that connect will LDAP will use LDAP setting by default
@taiwan-king commented on GitHub (Mar 12, 2025):
Yes,
Thank you for your reminder.
I did not set up LDAP Auth for authentication;
I only set up LDAP Auth for the password.
This should be the issue.
Thank you for your assistance.