[Help] LDAP with Authentik

[Sm1Ling]

Has anyone successfully configured the TOS 7 LDAP service with the Local Docker Authentik run?

I am using a Terramaster F4 424 Pro with TOS 7 installed. I have set up the Authentik service through Portainer and want to create a unified account storage for all services I want to use on the NAS.

To connect the user pool to the remote folders on the NAS, I need to link the NAS accounts to the Authentik account. However, I am facing a "Network blocked" issue.

Maybe someone has already resolved this issue while working with LDAP and the Authentik.

P.S. Already tried to get answers out of Gemini. It didn't help with the problem

[CursaYang]

On which screen does "network blocked" appear? Could you provide a screenshot?

If your ultimate goal is:
"Create a user in Authentik → TerraMaster can also recognize this user → use the same account when accessing NAS folders via SMB,"
then we recommend prioritizing the architecture of Authentik LDAP + TerraMaster LDAP client. Authentik's official documentation also explicitly provides an LDAP Provider and LDAP Outpost, which allow external devices to query the Authentik user directory via LDAP.
https://docs.goauthentik.io/add-secure- ... p-provider

[Sm1Ling]

Hello! Thank you for your response

I have created Ldap outpost, connected it with authentik app with binded provider
Error appears on the screen of TOS7 Ldap settings window. At the place where you insert LDAP connection credentials. As soon as i push Connect button I receive the error

I already have tried different configuration of ports forwarding in docker compose settings
389:389
389:1389
389:3389
1389:3389
And so on...

Tried different hosts
127.0.0.1,
Local NAS host,
Tried to add ldap:// prefix
Tried to hide port suffix

Nothing helped


I mean, may be someone could share one's own configs (without private info, of course) ?

[CursaYang]

Thank you for the detailed information. Since you have already tested different Docker port mappings and host formats, I suggest we verify whether the LDAP connection from the TOS 7 GUI actually reaches the Authentik LDAP Outpost.

For the standard Authentik configuration, the LDAP Outpost listens on container port 3389, so the recommended Docker mapping is:

389:3389

In the TOS 7 LDAP settings, please enter only the NAS IP address as the LDAP server and use port 389. For example:

LDAP Server: 192.168.x.x
Port: 389

Please do not add the ldap:// prefix for this test.

At the same time, please SSH into the NAS and run:

nc -zv <NAS_IP> 389

Then, while clicking the Connect button in the TOS 7 LDAP settings, please run:

docker logs -f <ldap-outpost-container>

We would like to check whether a connection from TOS 7 appears in the LDAP Outpost logs. If there is no new connection at all when you click Connect, this would indicate that the TOS 7 LDAP client is not reaching the Authentik LDAP Outpost, and we can investigate this separately from the Authentik configuration.

Please send us the result of the port test and the LDAP Outpost log generated when you click Connect.

[Sm1Ling]

Okay, let's try step by step

First, I deleted container with Outpost. Then deleted ports forwarding in authentik server's docker compose file (to free this port for further outpost container)
Then recreated oupost container via Authentik

It started listening for 389 and 636 ports

`nc -zv <NAS_IP> 389` returned
`Connection to <NAS_IP> 389 port [tcp/ldap] succeeded!`


`docker logs -f ak-outpost-tos-ldap` before ldap connection attempt gave
```
{"event":"Loaded config","level":"debug","path":"inbuilt-default","timestamp":"2026-09-14T20:28:34Z"}
{"event":"Loaded config from environment","level":"debug","timestamp":"2026-09-14T20:28:34Z"}
{"event":"not enabling debug server, set `AUTHENTIK_DEBUG` to `true` to enable it.","level":"info","logger":"authentik.go_debugger","timestamp":"2026-09-14T20:28:34Z"}
{"event":"Successfully connected websocket","level":"info","logger":"authentik.outpost.ak-ws","outpost":"...","timestamp":"2026-09-14T20:28:34Z"}
{"event":"Fetching certificate and private key","level":"info","logger":"authentik.outpost.cryptostore","timestamp":"2026-09-14T20:28:35Z","uuid":"..."}
{"event":"initialised direct binder","level":"info","logger":"authentik.outpost.ldap.binder.direct","timestamp":"2026-09-14T20:28:36Z"}
{"event":"Update providers","level":"info","logger":"authentik.outpost.ldap","timestamp":"2026-09-14T20:28:36Z"}
{"event":"Starting Metrics server","level":"info","listen":"0.0.0.0:9300","logger":"authentik.outpost.metrics","timestamp":"2026-09-14T20:28:36Z"}
{"event":"Starting LDAP server","level":"info","listen":"0.0.0.0:3389","logger":"authentik.outpost.ldap","timestamp":"2026-09-14T20:28:36Z"}
{"event":"Starting LDAP SSL server","level":"info","listen":"0.0.0.0:6636","logger":"authentik.outpost.ldap","timestamp":"2026-09-14T20:28:36Z"}
{"event":"Starting authentik outpost","hash":"tagged","level":"info","logger":"authentik.outpost","timestamp":"2026-09-14T20:28:36Z","version":"2024.8.3"}
{"event":"initialised direct binder","level":"info","logger":"authentik.outpost.ldap.binder.direct","timestamp":"2026-09-14T20:28:37Z"}
{"event":"Update providers","level":"info","logger":"authentik.outpost.ldap","timestamp":"2026-09-14T20:28:37Z"}
```
Then I try to create ldap connection

Adress of LDAP server: 192.168.X.Y
BaseDN: dc=ldap,dc=goauthentik,dc=io
BInd DN: cn=user,ou=users,dc=ldap,dc=goauthentik,dc=io

Aaaand

It did't show `Network blocked` error! Nice!
It even showed green texts:
`check DNS records. ok`
`check the network. ok`

But faced another error:
`Check the domain service. Failed to enable the domain service`

[CursaYang]

The fact that TOS now shows check DNS records. ok and check the network. ok means the previous Network blocked issue has been resolved, and TOS can now reach the LDAP Outpost.

The current error, Check the domain service. Failed to enable the domain service, occurs at a later stage. We would like to verify whether the LDAP bind and query are working correctly before investigating the TOS domain service itself.

Please first test the LDAP connection from the NAS with:

Code: Select all

ldapsearch -x \
-H ldap://192.168.X.Y:389 \
-D "cn=user,ou=users,dc=ldap,dc=goauthentik,dc=io" \
-W \
-b "dc=ldap,dc=goauthentik,dc=io" \
"(objectClass=*)"

Also, please run:

Code: Select all

docker logs -f ak-outpost-tos-ldap

Then click Apply in the TOS 7 LDAP settings and check whether any new LDAP connection or bind-related log appears in the Outpost.

If possible, please send us the ldapsearch result and the Outpost log generated when you click Apply. We can then determine whether the failure occurs during LDAP authentication/querying or when TOS tries to start its domain service.

[Sm1Ling]

Hello! Thank you for continuing to help!

Result of

Code: Select all

ldapsearch -x \
-H ldap://192.168.X.Y:389 \
-D "cn=user,ou=users,dc=ldap,dc=goauthentik,dc=io" \
-W \
-b "dc=ldap,dc=goauthentik,dc=io" \
"(objectClass=*)"

Is https://pastebin.com/dg4QVTRP


In my humble opinion, it successfully requested data

Code: Select all

docker logs -f ak-outpost-tos-ldap

show such logs after connection via terminal

Code: Select all

{"bindDN":"cn=akadmin,ou=users,dc=ldap,dc=goauthentik,dc=io","client":"192.168.X.Y","event":"User has access","level":"info","requestId":"324...","timestamp":"2026-09-15T21:57:32Z"}
{"bindDN":"cn=akadmin,ou=users,dc=ldap,dc=goauthentik,dc=io","client":"192.168.X.Y","event":"Bind request","level":"info","requestId":"324...","timestamp":"2026-09-15T21:57:32Z","took-ms":594}
{"attributes":[],"baseDN":"dc=ldap,dc=goauthentik,dc=io","bindDN":"cn=akadmin,ou=users,dc=ldap,dc=goauthentik,dc=io","client":"192.168.X.Y","event":"Search request","filter":"(objectClass=*)","level":"info","requestId":"674...","scope":"Whole Subtree","timestamp":"2026-09-15T21:57:32Z","took-ms":81}

After I tried to connect to LDAP from TOS7 Settings docker logs printed tons of data
https://pastebin.com/HSZHwns0


TOS7 UI response was same `Check the domain service. Failed to enable the domain service`