Issue Description
Since version 0.16.12 group memberships are not recognized anymore when using an Authentik LDAP directory.
Expected Behavior
The following ldap user is and stays part of the randomerror group:
dn: cn=me,ou=users,ou=stalwart-mail,dc=ldap,dc=goauthentik,dc=io
objectClass: person
ak-active: TRUE
memberOf: cn=randomerror,ou=groups,ou=stalwart-mail,dc=ldap,dc=goauthentik,dc=io
displayName: Me
mail: [email protected]
pwdChangedTime: 20260125113615Z
…
Actual Behavior
When logging in with [email protected] the account is removed from the randomerror group.
Reproduction Steps
- Configure Stalwart with an LDAP directory
Login Filter: (&(objectClass=user)(mail=?))
Mailbox Filter: (&(objectClass=user)(|(mail=?)(emailAliases=?)))
Member Of Filter: (&(objectClass=group)(member=?))
Account Type Attribute: objectClass
Description Attribute: displayName
Primary E-mail Attribute: mail
E-mail Alias Attribute: emailAliases
Member Of Attribute: memberOf
Password Changed Attribute: pwdChangedTime
Group Object Class: group
- Log in with a user that is part of a group
Relevant Log Output
2026-07-06T21:35:48Z TRACE LDAP query executed (store.ldap-query) details = “(&(objectClass=user)([email protected]))”, result = [[“mail”, “[email protected]”], [“emailAliases”, “”], [“objectClass”, “top, person, organizationalPerson, inetOrgPerson, user, posixAccount, goauthentik.io/ldap/user”], [“memberOf”, “cn=randomerror,ou=groups,ou=stalwart-mail,dc=ldap,dc=goauthentik,dc=io”], [“pwdChangedTime”, “20260125113615Z”], [
“displayName”, “Me”], “cn=me,ou=users,ou=stalwart-mail,dc=ldap,dc=goauthentik,dc=io”]
Stalwart Version
v0.16.x
Installation Method
Docker
Database Backend
RocksDB
Blob Storage
RocksDB
Search Engine
Internal
Directory Backend
LDAP
Additional Context
An ldap search for (&(objectClass=user)([email protected])) correctly returns the user with memberOf attributes, and the reverse search for (&(objectClass=group)(member=?)) with the user dn also returns the group.
I have reviewed the documentation and FAQ and confirm that my issue is NOT addressed there.
on
I have searched this support forum (open and closed topics) and confirm this is not a duplicate.
on
I understand that topics in this category are triaged by a bot first but a human reply will follow up. If I’d prefer a human-only reply, I’ll add the no-ai tag to my topic.
on