Reduce LDAP proxy user sign-ins with direct bind

[runleveldev]

I've been utilizing Authentik with it's LDAP outpost to enable SSSD LDAP logins for my servers. We landed on this solution due to the ability to use DUO push notifications as the 2FA mechanism for the login even over SSH. SSSD is configured with a "proxy user" which bypasses 2FA requirements to perform it's initial searches with. This works fairly well, but the event logs in Authentik are spammed with logins from the proxy user due to the number of servers we have utilizing it. I know cached binding would fix this, but it would also remove the ability to use DUO 2FA during the bind. Are there any ways to exclude the proxy user's LDAP binds from the login events?

The original motivation here was I was investigating the system performance and it seems that each login queues a "Dispatch new event notifications." task. I could scale my workers to handle these faster, but I don't like the idea that my worker count has to scale linearly with my SSSD instance count. If I could just get the ldap proxy user's binds to bypass that I shouldn't have any issue for a while.

[mohammadrezwankhan]

[runleveldev]

For an SSSD proxy account, I would separate the service-account path from the user-login path:

1. Keep the user-facing LDAP provider/flow on direct bind with the Duo stage.

2. Create a dedicated LDAP provider (or a dedicated bind flow) for the SSSD search account. Give that account only the required LDAP search permission, use a unique Base DN if you have multiple providers, and use cached bind or a password-only flow for that service account. Restrict the provider/outpost to the SSSD hosts with your network policy.

3. Do not use the proxy account as the account that performs interactive user authentication. That prevents a directory-search bind from being treated like a human Duo login while leaving Duo enabled for users.

I will try this and report back.

[runleveldev]

Here's what I tried:

• ldap provider: direct bind, cached search, base dc=ldap,dc=example,dc=com
• ldap-search provider: cached bind, cached search, base dc=ldap,dc=goauthentik,dc=io
• ldap-proxyuser user
• ldap1 outpost: both providers attached
• sssd

# /etc/sssd/sssd.conf
[sssd]
domains = default

[domain/default]
id_provider = ldap
auth_provider = ldap
access_provider = ldap
ldap_uri = ldaps://ldap1.example.com:6636
ldap_tls_reqcert = allow

ldap_schema = rfc2307bis
ldap_search_base = dc=ldap,dc=example,dc=com
ldap_user_search_base = ou=users,dc=ldap,dc=example,dc=com
ldap_group_search_base = dc=ldap,dc=example,dc=com

ldap_user_name = cn
ldap_user_gecos = displayName

# Expose the user's SSH public key (stored on the LDAP `sshPublicKey` attribute)
# so it can be served to sshd via `sss_ssh_authorizedkeys`.
ldap_user_ssh_public_key = sshPublicKey

ldap_access_order = filter
ldap_access_filter = (&(memberOf=cn=ldapusers,ou=groups,dc=ldap,dc=example,dc=com)(ak-active=true))

ldap_default_bind_dn = cn=ldap-proxyuser,ou=users,dc=ldap,dc=goauthentik,dc=io
ldap_default_authtok_type = password
ldap_default_authtok = REDACTED

# set a timeout long enough for a push notification to be responded to
ldap_opt_timeout = 60

fallback_homedir = /home/%u
default_shell = /bin/bash

Expectation: sssd binds against the outpost as the proxy user using the cached binding from the dc=ldap,dc=goauthentik,dc=io tree but search is performed against the dc=ldap,dc=example,dc=com tree allowing interactive logins to use direct bind but searches to use cached binds.

Reality: the LDAP outpost treats the 2 subtrees as completely separate instances. The proxy user successfully authenticating against the dc=ldap,dc=goauthentik,dc=io tree gives it no visibility into the dc=ldap,dc=example,dc=com tree. This is verified by the log line:

{"event":"Fallback to default cert","level":"debug","logger":"authentik.outpost.ldap","server-name":"ldap1.example.com","timestamp":"2026-08-11T16:09:16Z"}
{"bindDN":"cn=ldap-proxyuser,ou=users,dc=ldap,dc=goauthentik,dc=io","client":"10.17.18.227","error":"invalid base DN","event":"Username not for instance","level":"debug","requestId":"ba6cd1f5-0c23-4e70-8ee3-531d8abcf160","timestamp":"2026-08-11T16:09:16Z"}
{"bindDN":"cn=ldap-proxyuser,ou=users,dc=ldap,dc=goauthentik,dc=io","event":"authenticated from session","level":"info","logger":"authentik.outpost.ldap.binder.session","timestamp":"2026-08-11T16:09:16Z"}
{"bindDN":"cn=ldap-proxyuser,ou=users,dc=ldap,dc=goauthentik,dc=io","client":"10.17.18.227","event":"Bind request","level":"info","requestId":"ba6cd1f5-0c23-4e70-8ee3-531d8abcf160","timestamp":"2026-08-11T16:09:16Z","took-ms":0}
{"attributes":[],"baseDN":"dc=ldap,dc=example,dc=com","bindDN":"cn=ldap-proxyuser,ou=users,dc=ldap,dc=goauthentik,dc=io","client":"10.17.18.227","event":"Search request","filter":"(objectclass=*)","level":"info","requestId":"c214cd39-48b3-4ac1-83ad-69aedfb98af2","scope":"Whole Subtree","timestamp":"2026-08-11T16:09:16Z","took-ms":0}