Kerberos and LDAP sources do not create source connections for existing users
Author: sgebauerCreated Sep 11, 2026Updated Sep 17, 2026
Labelsbugstatus/reviewing
Describe the bug
A Kerberos source with "Link to a user with identical username" does not create source connections for existing Authentik users. Therefore, Authentik does not use their Kerberos passwords even after a "successful" sync of the Kerberos Source.
#21326 describes a similar problem with (probably) the same root cause.
The same problem also applies to the LDAP source. So when LDAP and Kerberos are used together, new users get linked to either LDAP or Kerberos, depending on which source enrolled them.
How to reproduce
- Create a user in Authentik and Kerberos (with identical usernames)
- Create a Kerberos Source with "User matching mode: Link to a user with identical username"
- Run the "Sync Kerberos source" job
Expected behavior
- A Kerberos source connection should be created for the user (as listed in
/api/v3/sources/user_connections/kerberos/) - The user should now be able to log in with their Kerberos password
- Password changes for the user should be passed on to Kerberos (if "User password writeback" is enabled)
Screenshots
No response
Additional context
No response
Deployment Method
Docker
Version
2026.8.0
Relevant log output
Sep 10 15:40:19 authentik systemd-authentik-worker[162699]: {"domain_url": null, "event": "Mapping evaluated to None or is not a dict. Skipping", "level": "debug", "logger": "authentik.core.sources.mapper", "mapping": "<KerberosSourcePropertyMapping: authentik default Kerberos User Mapping: Ignore other realms>", "pid": 18, "schema_name": "public", "source": "<authentik.core.sources.mapper.SourceMapper object at 0x7f2f9c266780>", "timestamp": "2026-09-10T13:40:19.751880"}
Sep 10 15:40:19 authentik systemd-authentik-worker[162699]: {"domain_url": null, "event": "Mapping evaluated to None or is not a dict. Skipping", "level": "debug", "logger": "authentik.core.sources.mapper", "mapping": "<KerberosSourcePropertyMapping: authentik default Kerberos User Mapping: Ignore system principals>", "pid": 18, "schema_name": "public", "source": "<authentik.core.sources.mapper.SourceMapper object at 0x7f2f9c266780>", "timestamp": "2026-09-10T13:40:19.752052"}
Sep 10 15:40:19 authentik systemd-authentik-worker[162699]: {"domain_url": null, "event": "Mapping evaluated to None or is not a dict. Skipping", "level": "debug", "logger": "authentik.core.sources.mapper", "mapping": "<KerberosSourcePropertyMapping: authentik default Kerberos User Mapping: Multipart principals as service accounts>", "pid": 18, "schema_name": "public", "source": "<authentik.core.sources.mapper.SourceMapper object at 0x7f2f9c266780>", "timestamp": "2026-09-10T13:40:19.752200"}
Sep 10 15:40:19 authentik systemd-authentik-worker[162699]: {"attributes": {}, "domain_url": null, "event": "Writing user with attributes", "is_active": true, "level": "debug", "logger": "authentik.sources.kerberos.sync", "path": "Users", "pid": 18, "schema_name": "public", "source": "<KerberosSource: Kerberos Source My Kerberos>", "syncer": "KerberosSync", "timestamp": "2026-09-10T13:40:19.752265", "type": "internal", "username": "enton"}
Sep 10 15:40:19 authentik systemd-authentik-worker[162699]: {"domain_url": null, "event": "Trying to link with existing object", "identifier": "[email protected]", "level": "debug", "logger": "authentik.core.sources.matcher", "pid": 18, "query": "<Q: (AND: ('username__exact', 'enton'))>", "schema_name": "public", "source": "<KerberosSource: Kerberos Source My Kerberos>", "timestamp": "2026-09-10T13:40:19.753123"}
Sep 10 15:40:19 authentik systemd-authentik-worker[162699]: {"action": "<Action.LINK: 'link'>", "connection": "<UserKerberosSourceConnection: User-source connection (user=3107, source=8971ee75-74d4-4600-9ec1-53cc1163d82f)>", "domain_url": null, "event": "Action returned", "level": "debug", "logger": "authentik.sources.kerberos.sync", "pid": 18, "schema_name": "public", "source": "<KerberosSource: Kerberos Source My Kerberos>", "syncer": "KerberosSync", "timestamp": "2026-09-10T13:40:19.754442"}
Sep 10 15:40:19 authentik systemd-authentik-worker[162699]: {"domain_url": null, "event": "Synced User", "level": "debug", "logger": "authentik.sources.kerberos.sync", "pid": 18, "schema_name": "public", "source": "<KerberosSource: Kerberos Source My Kerberos>", "syncer": "KerberosSync", "timestamp": "2026-09-10T13:40:19.759919", "user": "enton"}Source: goauthentik/authentik