[GH-ISSUE #794] [Feature]: LDAP auth

BreizhHardware commented

2026-05-07 00:11:18 +02:00

Owner

Originally created by @dlawler489 on GitHub (Mar 24, 2026).
Original GitHub issue: https://github.com/maziggy/bambuddy/issues/794

Originally assigned to: @maziggy on GitHub.

Problem or Use Case

Would love a way to allow for LDAP auth for users to auth to Bambuddy, rather than local accounts

Proposed Solution

LDAP auth, coming from Active Directory - SAML with EntraID would be even better, but that could be harder.
User groups based on AD/ Entra Groups (so, something like, Bambuddy_Operator, Bambuddy_Admin, Bambuddy_Viewer).

Alternatives Considered

Not really any workarounds for it.

Feature Category

Other

Priority

Nice to have

Mockups or Examples

No response

Contribution

I would be willing to help implement this feature

Checklist

I have searched existing issues to ensure this feature hasn't already been requested

Originally created by @dlawler489 on GitHub (Mar 24, 2026). Original GitHub issue: https://github.com/maziggy/bambuddy/issues/794 Originally assigned to: @maziggy on GitHub. ### Problem or Use Case Would love a way to allow for LDAP auth for users to auth to Bambuddy, rather than local accounts ### Proposed Solution LDAP auth, coming from Active Directory - SAML with EntraID would be even better, but that could be harder. User groups based on AD/ Entra Groups (so, something like, Bambuddy_Operator, Bambuddy_Admin, Bambuddy_Viewer). ### Alternatives Considered Not really any workarounds for it. ### Feature Category Other ### Priority Nice to have ### Mockups or Examples _No response_ ### Contribution - [ ] I would be willing to help implement this feature ### Checklist - [x] I have searched existing issues to ensure this feature hasn't already been requested

BreizhHardware

2026-05-07 00:11:19 +02:00

closed this issue
added the
enhancement
label

BreizhHardware commented

2026-05-07 00:11:19 +02:00

Author

Owner

@maziggy commented on GitHub (Mar 24, 2026):

Before we commit to building this, I'd like to gauge community interest. If you'd find this feature useful, please give this issue a thumbs up (👍) reaction so we can prioritize accordingly.

@maziggy commented on GitHub (Mar 24, 2026): Before we commit to building this, I'd like to gauge community interest. If you'd find this feature useful, please give this issue a thumbs up (👍) reaction so we can prioritize accordingly.

BreizhHardware commented

2026-05-07 00:11:19 +02:00

Author

Owner

@maziggy commented on GitHub (Apr 5, 2026):

Quick note on scope: We'll be implementing pure LDAP bind authentication. SAML, OIDC, and Entra ID/Azure AD integrations are out of scope — we want to keep this clean and dependency-light.

Before we start building, we'd love community input on a few design questions:

Coexistence with local accounts

Should LDAP users exist alongside local accounts? (e.g., local admin as fallback when LDAP server is unreachable)
Or should enabling LDAP replace local auth entirely?

Group-to-role mapping

Should we map LDAP groups to Bambuddy's existing roles (Admin, Operator, Viewer)?
If so, should this be configurable? (e.g., "LDAP group PrintFarm_Admins → Bambuddy Admin")
Or should all LDAP users get the same default role, with admins promoting manually?

User provisioning

Auto-create Bambuddy user on first successful LDAP login (just-in-time provisioning)?
Or require an admin to pre-register allowed LDAP usernames?

Configuration

LDAP server URL, bind DN, search base, group filter — anything else you'd need for your setup?
Does anyone need LDAPS (LDAP over TLS) or StartTLS?

Please share your thoughts and upvote the options that work best for your environment!

@maziggy commented on GitHub (Apr 5, 2026): Quick note on scope: We'll be implementing pure LDAP bind authentication. **SAML, OIDC, and Entra ID/Azure AD integrations are out of scope — we want to keep this clean and dependency-light**. Before we start building, we'd love community input on a few design questions: 1. Coexistence with local accounts - Should LDAP users exist alongside local accounts? (e.g., local admin as fallback when LDAP server is unreachable) - Or should enabling LDAP replace local auth entirely? 2. Group-to-role mapping - Should we map LDAP groups to Bambuddy's existing roles (Admin, Operator, Viewer)? - If so, should this be configurable? (e.g., "LDAP group PrintFarm_Admins → Bambuddy Admin") - Or should all LDAP users get the same default role, with admins promoting manually? 3. User provisioning - Auto-create Bambuddy user on first successful LDAP login (just-in-time provisioning)? - Or require an admin to pre-register allowed LDAP usernames? 4. Configuration - LDAP server URL, bind DN, search base, group filter — anything else you'd need for your setup? - Does anyone need LDAPS (LDAP over TLS) or StartTLS? Please share your thoughts and upvote the options that work best for your environment!

BreizhHardware commented

2026-05-07 00:11:19 +02:00

Author

Owner

@dlawler489 commented on GitHub (Apr 5, 2026):

Hi Maziggy,

I would think, LDAP should exist with local accounts - at least just the admin account, so if the server isn't available the admin can fix it easier.
Yes, role mapping would be great. And yes, configurable options for the name of the AD based groups please. Different places have different requirements for naming of things in AD. If the roles are too hard, admins can change the user afterwards, that's ok too, but having it automated based on the AD group would be great.
User provisioning, perhaps leave that up to the admin to decide. I would rather add people who need access, than have it be a free for all.
Those LDAP options should be fine, maybe support LDAPS if you have time? Probably should moving forward.
Thanks for all the amazing work you've done with this project!

@dlawler489 commented on GitHub (Apr 5, 2026): Hi Maziggy, 1. I would think, LDAP should exist with local accounts - at least just the admin account, so if the server isn't available the admin can fix it easier. 2. Yes, role mapping would be great. And yes, configurable options for the name of the AD based groups please. Different places have different requirements for naming of things in AD. If the roles are too hard, admins can change the user afterwards, that's ok too, but having it automated based on the AD group would be great. 3. User provisioning, perhaps leave that up to the admin to decide. I would rather add people who need access, than have it be a free for all. 4. Those LDAP options should be fine, maybe support LDAPS if you have time? Probably should moving forward. Thanks for all the amazing work you've done with this project!

BreizhHardware commented

2026-05-07 00:11:19 +02:00

Author

Owner

@maziggy commented on GitHub (Apr 8, 2026):

Available/Fixed in branch dev and available with the next release or daily build. Please let me know if it works for you.

Docs -> https://wiki.bambuddy.cool/features/authentication/?h=ldap#setting-up-ldap

@maziggy commented on GitHub (Apr 8, 2026): Available/Fixed in branch dev and available with the next release or daily build. Please let me know if it works for you. Docs -> https://wiki.bambuddy.cool/features/authentication/?h=ldap#setting-up-ldap

BreizhHardware commented

2026-05-07 00:11:20 +02:00

Author

Owner

@DylanBrass commented on GitHub (Apr 11, 2026):

Available/Fixed in branch dev and available with the next release or daily build. Please let me know if it works for you.

Docs -> https://wiki.bambuddy.cool/features/authentication/?h=ldap#setting-up-ldap

Hello !

I am getting this error on the daily release :

[bambuddy] 2026-04-11T05:29:55.225572463Z 2026-04-11 01:29:55,225 INFO [backend.app.services.ldap_service] LDAP authentication successful for user: <USER> (DN: cn=<USER>,ou=users,dc=ldap,dc=goauthentik,dc=io, groups: 14)
[bambuddy] 2026-04-11T05:29:55.239484820Z INFO:     192.168.5.149:52516 - "POST /api/v1/printers/camera/stream-token HTTP/1.1" 401 Unauthorized
[bambuddy] 2026-04-11T05:29:55.246772906Z 2026-04-11 01:29:55,246 WARNING [backend.app.api.routes.auth] LDAP authentication error, falling back to local: (sqlite3.IntegrityError) NOT NULL constraint failed: users.password_hash
[bambuddy] 2026-04-11T05:29:55.246825316Z [SQL: INSERT INTO users (username, email, password_hash, role, auth_source, is_active, cloud_token, cloud_email) VALUES (?, ?, ?, ?, ?, ?, ?, ?) RETURNING id, created_at, updated_at]
[bambuddy] 2026-04-11T05:29:55.246847306Z [parameters: ('<USER>', '<EMAIL>', None, 'user', 'ldap', 1, None, None)]
[bambuddy] 2026-04-11T05:29:55.246863446Z (Background on this error at: https://sqlalche.me/e/20/gkpj)
[bambuddy] 2026-04-11T05:29:55.249384743Z INFO:     192.168.5.149:52502 - "POST /api/v1/auth/login HTTP/1.1" 500 Internal Server Error
[bambuddy] 2026-04-11T05:29:55.277639538Z ERROR:    Exception in ASGI application
[bambuddy] 2026-04-11T05:29:55.277734528Z   + Exception Group Traceback (most recent call last):
[bambuddy] 2026-04-11T05:29:55.277755791Z   |   File "/usr/local/lib/python3.13/site-packages/starlette/_utils.py", line 81, in collapse_excgroups
[bambuddy] 2026-04-11T05:29:55.277772751Z   |     yield
[bambuddy] 2026-04-11T05:29:55.277789068Z   |   File "/usr/local/lib/python3.13/site-packages/starlette/middleware/base.py", line 192, in __call__
[bambuddy] 2026-04-11T05:29:55.277808815Z   |     async with anyio.create_task_group() as task_group:
[bambuddy] 2026-04-11T05:29:55.277827008Z   |                ~~~~~~~~~~~~~~~~~~~~~~~^^
[bambuddy] 2026-04-11T05:29:55.277841828Z   |   File "/usr/local/lib/python3.13/site-packages/anyio/_backends/_asyncio.py", line 799, in __aexit__
[bambuddy] 2026-04-11T05:29:55.277856745Z   |     raise BaseExceptionGroup(
[bambuddy] 2026-04-11T05:29:55.277874262Z   |         "unhandled errors in a TaskGroup", self._exceptions
[bambuddy] 2026-04-11T05:29:55.277891218Z   |     ) from None
[bambuddy] 2026-04-11T05:29:55.277930322Z   | ExceptionGroup: unhandled errors in a TaskGroup (1 sub-exception)
[bambuddy] 2026-04-11T05:29:55.277952902Z   +-+---------------- 1 ----------------
[bambuddy] 2026-04-11T05:29:55.277967392Z     | Traceback (most recent call last):
[bambuddy] 2026-04-11T05:29:55.277983458Z     |   File "/usr/local/lib/python3.13/site-packages/uvicorn/protocols/http/httptools_impl.py", line 420, in run_asgi
[bambuddy] 2026-04-11T05:29:55.278001628Z     |     result = await app(
[bambuddy] 2026-04-11T05:29:55.278016282Z     |         self.scope, self.receive, self.send
[bambuddy] 2026-04-11T05:29:55.278033588Z     |     )
[bambuddy] 2026-04-11T05:29:55.278085962Z     |   File "/usr/local/lib/python3.13/site-packages/uvicorn/middleware/proxy_headers.py", line 60, in __call__
[bambuddy] 2026-04-11T05:29:55.278103285Z     |     return await self.app(scope, receive, send)
[bambuddy] 2026-04-11T05:29:55.278150642Z     |   File "/usr/local/lib/python3.13/site-packages/fastapi/applications.py", line 1163, in __call__
[bambuddy] 2026-04-11T05:29:55.278167375Z     |     await super().__call__(scope, receive, send)
[bambuddy] 2026-04-11T05:29:55.278200202Z     |   File "/usr/local/lib/python3.13/site-packages/starlette/applications.py", line 90, in __call__
[bambuddy] 2026-04-11T05:29:55.278216579Z     |     await self.middleware_stack(scope, receive, send)
[bambuddy] 2026-04-11T05:29:55.278237065Z     |   File "/usr/local/lib/python3.13/site-packages/starlette/middleware/errors.py", line 186, in __call__
[bambuddy] 2026-04-11T05:29:55.278253505Z     |     raise exc
...
[bambuddy] 2026-04-11T05:29:55.282845141Z [SQL: INSERT INTO users (username, email, password_hash, role, auth_source, is_active, cloud_token, cloud_email) VALUES (?, ?, ?, ?, ?, ?, ?, ?) RETURNING id, created_at, updated_at]
[bambuddy] 2026-04-11T05:29:55.282866371Z [parameters: ('<USER>', '<EMAIL>', None, 'user', 'ldap', 1, None, None)]
[bambuddy] 2026-04-11T05:29:55.282938561Z (Background on this error at: https://sqlalche.me/e/20/gkpj) (Background on this error at: https://sqlalche.me/e/20/7s2a)
[bambuddy] 2026-04-11T05:29:58.794645849Z INFO:     127.0.0.1:33778 - "GET /health HTTP/1.1" 200 OK

It seems to try to insert my user without a password and crashing.

@DylanBrass commented on GitHub (Apr 11, 2026): > Available/Fixed in branch dev and available with the next release or daily build. Please let me know if it works for you. > > Docs -> https://wiki.bambuddy.cool/features/authentication/?h=ldap#setting-up-ldap Hello ! I am getting this error on the daily release : ``` [bambuddy] 2026-04-11T05:29:55.225572463Z 2026-04-11 01:29:55,225 INFO [backend.app.services.ldap_service] LDAP authentication successful for user: <USER> (DN: cn=<USER>,ou=users,dc=ldap,dc=goauthentik,dc=io, groups: 14) [bambuddy] 2026-04-11T05:29:55.239484820Z INFO: 192.168.5.149:52516 - "POST /api/v1/printers/camera/stream-token HTTP/1.1" 401 Unauthorized [bambuddy] 2026-04-11T05:29:55.246772906Z 2026-04-11 01:29:55,246 WARNING [backend.app.api.routes.auth] LDAP authentication error, falling back to local: (sqlite3.IntegrityError) NOT NULL constraint failed: users.password_hash [bambuddy] 2026-04-11T05:29:55.246825316Z [SQL: INSERT INTO users (username, email, password_hash, role, auth_source, is_active, cloud_token, cloud_email) VALUES (?, ?, ?, ?, ?, ?, ?, ?) RETURNING id, created_at, updated_at] [bambuddy] 2026-04-11T05:29:55.246847306Z [parameters: ('<USER>', '<EMAIL>', None, 'user', 'ldap', 1, None, None)] [bambuddy] 2026-04-11T05:29:55.246863446Z (Background on this error at: https://sqlalche.me/e/20/gkpj) [bambuddy] 2026-04-11T05:29:55.249384743Z INFO: 192.168.5.149:52502 - "POST /api/v1/auth/login HTTP/1.1" 500 Internal Server Error [bambuddy] 2026-04-11T05:29:55.277639538Z ERROR: Exception in ASGI application [bambuddy] 2026-04-11T05:29:55.277734528Z + Exception Group Traceback (most recent call last): [bambuddy] 2026-04-11T05:29:55.277755791Z | File "/usr/local/lib/python3.13/site-packages/starlette/_utils.py", line 81, in collapse_excgroups [bambuddy] 2026-04-11T05:29:55.277772751Z | yield [bambuddy] 2026-04-11T05:29:55.277789068Z | File "/usr/local/lib/python3.13/site-packages/starlette/middleware/base.py", line 192, in __call__ [bambuddy] 2026-04-11T05:29:55.277808815Z | async with anyio.create_task_group() as task_group: [bambuddy] 2026-04-11T05:29:55.277827008Z | ~~~~~~~~~~~~~~~~~~~~~~~^^ [bambuddy] 2026-04-11T05:29:55.277841828Z | File "/usr/local/lib/python3.13/site-packages/anyio/_backends/_asyncio.py", line 799, in __aexit__ [bambuddy] 2026-04-11T05:29:55.277856745Z | raise BaseExceptionGroup( [bambuddy] 2026-04-11T05:29:55.277874262Z | "unhandled errors in a TaskGroup", self._exceptions [bambuddy] 2026-04-11T05:29:55.277891218Z | ) from None [bambuddy] 2026-04-11T05:29:55.277930322Z | ExceptionGroup: unhandled errors in a TaskGroup (1 sub-exception) [bambuddy] 2026-04-11T05:29:55.277952902Z +-+---------------- 1 ---------------- [bambuddy] 2026-04-11T05:29:55.277967392Z | Traceback (most recent call last): [bambuddy] 2026-04-11T05:29:55.277983458Z | File "/usr/local/lib/python3.13/site-packages/uvicorn/protocols/http/httptools_impl.py", line 420, in run_asgi [bambuddy] 2026-04-11T05:29:55.278001628Z | result = await app( [bambuddy] 2026-04-11T05:29:55.278016282Z | self.scope, self.receive, self.send [bambuddy] 2026-04-11T05:29:55.278033588Z | ) [bambuddy] 2026-04-11T05:29:55.278085962Z | File "/usr/local/lib/python3.13/site-packages/uvicorn/middleware/proxy_headers.py", line 60, in __call__ [bambuddy] 2026-04-11T05:29:55.278103285Z | return await self.app(scope, receive, send) [bambuddy] 2026-04-11T05:29:55.278150642Z | File "/usr/local/lib/python3.13/site-packages/fastapi/applications.py", line 1163, in __call__ [bambuddy] 2026-04-11T05:29:55.278167375Z | await super().__call__(scope, receive, send) [bambuddy] 2026-04-11T05:29:55.278200202Z | File "/usr/local/lib/python3.13/site-packages/starlette/applications.py", line 90, in __call__ [bambuddy] 2026-04-11T05:29:55.278216579Z | await self.middleware_stack(scope, receive, send) [bambuddy] 2026-04-11T05:29:55.278237065Z | File "/usr/local/lib/python3.13/site-packages/starlette/middleware/errors.py", line 186, in __call__ [bambuddy] 2026-04-11T05:29:55.278253505Z | raise exc ... [bambuddy] 2026-04-11T05:29:55.282845141Z [SQL: INSERT INTO users (username, email, password_hash, role, auth_source, is_active, cloud_token, cloud_email) VALUES (?, ?, ?, ?, ?, ?, ?, ?) RETURNING id, created_at, updated_at] [bambuddy] 2026-04-11T05:29:55.282866371Z [parameters: ('<USER>', '<EMAIL>', None, 'user', 'ldap', 1, None, None)] [bambuddy] 2026-04-11T05:29:55.282938561Z (Background on this error at: https://sqlalche.me/e/20/gkpj) (Background on this error at: https://sqlalche.me/e/20/7s2a) [bambuddy] 2026-04-11T05:29:58.794645849Z INFO: 127.0.0.1:33778 - "GET /health HTTP/1.1" 200 OK ``` It seems to try to insert my user without a password and crashing.

BreizhHardware commented

2026-05-07 00:11:20 +02:00

Author

Owner

@maziggy commented on GitHub (Apr 11, 2026):

Available/Fixed in branch dev and available with the next release or daily build. Please let me know it it works for you now.

If you find Bambuddy useful, please consider giving it a ⭐ on GitHub — it helps others discover the project!

@maziggy commented on GitHub (Apr 11, 2026): Available/Fixed in branch dev and available with the next release or daily build. Please let me know it it works for you now. ----- If you find Bambuddy useful, please consider giving it a ⭐ on [GitHub](https://github.com/maziggy/bambuddy) — it helps others discover the project!

BreizhHardware commented

2026-05-07 00:11:20 +02:00

Author

Owner

@maziggy commented on GitHub (Apr 15, 2026):

Guys, how is it going?

@maziggy commented on GitHub (Apr 15, 2026): Guys, how is it going?

BreizhHardware commented

2026-05-07 00:11:20 +02:00

Author

Owner

@dlawler489 commented on GitHub (Apr 27, 2026):

Hi, sorry, been a busy couple of weeks, only just got to update Bambuddy and test it. Working as expected! Thanks heaps!

@dlawler489 commented on GitHub (Apr 27, 2026): Hi, sorry, been a busy couple of weeks, only just got to update Bambuddy and test it. Working as expected! Thanks heaps!

Rows
Columns

[GH-ISSUE #794] [Feature]: LDAP auth #528

Problem or Use Case

Proposed Solution

Alternatives Considered

Feature Category

Priority

Mockups or Examples

Contribution

Checklist