版块 › 安全类 › 零信任aTrust › 深信服Atrust如何对接Authentik LDAP?
深信服Atrust如何对接Authentik LDAP?

博涛科技   2026-8-6 18:02  1319  

{{ttag.title}}
项目背景：
公司之前架设了一个开源的统一认证平台Authentik 用来对接公司的各业务系统，最近想着把Atrust也对接上.

故障现象
可以导入用户和分组，但是用户在根目录

相关参数：
用户过滤&(objectClass=person)(sAMAccountName=*)(!(sAMAccountName=ak*)))
组过滤：(&(objectClass=group)(uid=*-*)(!(cn=authentik*)))
角色过滤：(&(objectClass=group)(uid=*-*)(!(cn=authentik*)))

ldapsearch 输出
  1. ---------------- ldapsearch -x   -H ldap://192.168.30.210:389   -D "cn=akadmin,ou=users,dc=arc,dc=com"   -w "Arc2026?"   -b "dc=arc,dc=com"  "(cn=duantao)" ---------------
  2. # extended LDIF
  3. #
  4. wave@wave:~$ ldapsearch -x   -H ldap://192.168.250.250:389   -D "cn=akadmin,ou=users,dc=arc,dc=com"   -w "Arc2026?"   -b "dc=arc,dc=com"
  5. #
  6. # LDAPv3
  7. # base <dc=arc,dc=com> with scope subtree
  8. # filter: (objectclass=*)
  9. # requesting: ALL
  10. #

  12. # arc.COM
  13. dn: DC=arc,DC=COM
  14. objectClass: top
  15. entryDN:
  16. supportedLDAPVersion: 3
  17. supportedCapabilities: 1.2.840.113556.1.4.800
  18. supportedCapabilities: 1.2.840.113556.1.4.1791
  19. supportedCapabilities: 1.2.840.113556.1.4.1670
  20. supportedCapabilities: 1.2.840.113556.1.4.1880
  21. supportedCapabilities: 1.2.840.113556.1.4.1851
  22. supportedCapabilities: 1.2.840.113556.1.4.1920
  23. supportedCapabilities: 1.2.840.113556.1.4.1935
  24. supportedCapabilities: 1.2.840.113556.1.4.2080
  25. supportedCapabilities: 1.2.840.113556.1.4.2237
  26. supportedControl: 2.16.840.1.113730.3.4.9
  27. supportedControl: 2.16.840.1.113730.3.4.10
  28. supportedControl: 1.2.840.113556.1.4.474
  29. supportedControl: 1.2.840.113556.1.4.319
  30. subschemaSubentry: cn=subschema
  31. namingContexts: dc=arc,dc=com
  32. rootDomainNamingContext: dc=arc,dc=com
  33. vendorName: goauthentik.io
  34. vendorVersion: authentik LDAP Outpost Version 2026.2.3

  36. # users, arc.com
  37. dn: ou=users,dc=arc,dc=com
  38. distinguishedName: ou=users,dc=arc,dc=com
  39. objectClass: top
  40. objectClass: nsContainer
  41. commonName: users

  43. # ak-outpost-5c571a6db0554d1dad11b1ffb4d9fd4e, users, arc.com
  44. dn: cn=ak-outpost-5c571a6db0554d1dad11b1ffb4d9fd4e,ou=users,dc=arc,dc=com
  45. uid: b3ae2bdc44a80225b0008def0f65298d2ca60a3114b666d30411e0231e46e65d
  46. displayName: Outpost LDAP Service-Account
  47. sn: Outpost LDAP Service-Account
  48. createTimestamp: 20260520085956Z
  49. modifyTimestamp: 20260520085956Z
  50. sAMAccountName: ak-outpost-5c571a6db0554d1dad11b1ffb4d9fd4e
  51. mail:
  52. homeDirectory: /home/ak-outpost-5c571a6db0554d1dad11b1ffb4d9fd4e
  53. pwdChangedTime: 20260520085956Z
  54. ak-superuser: FALSE
  55. cn: ak-outpost-5c571a6db0554d1dad11b1ffb4d9fd4e
  56. name: Outpost LDAP Service-Account
  57. objectClass: top
  58. objectClass: person
  59. objectClass: organizationalPerson
  60. objectClass: inetOrgPerson
  61. objectClass: user
  62. objectClass: posixAccount
  63. objectClass: goauthentik.io/ldap/user
  64. uidNumber: 2005
  65. ak-active: TRUE
  66. gidNumber: 2005

  68. # ak-outpost-7dc975f1d72e490ea98759961b273f59, users, arc.com
  69. dn: cn=ak-outpost-7dc975f1d72e490ea98759961b273f59,ou=users,dc=arc,dc=com
  70. sAMAccountName: ak-outpost-7dc975f1d72e490ea98759961b273f59
  71. gidNumber: 2002
  72. pwdChangedTime: 20260520085315Z
  73. createTimestamp: 20260520085315Z
  74. uid: a55fb72010340fd2f693ddacad2649c6ebaa90d3c7f23e59cfb558ffea2dd879
  75. name: Outpost authentik Embedded Outpost Service-Account
  76. displayName: Outpost authentik Embedded Outpost Service-Account
  77. uidNumber: 2002
  78. sn: Outpost authentik Embedded Outpost Service-Account
  79. ak-active: TRUE
  80. cn: ak-outpost-7dc975f1d72e490ea98759961b273f59
  81. mail:
  82. ak-superuser: FALSE
  83. objectClass: top
  84. objectClass: person
  85. objectClass: organizationalPerson
  86. objectClass: inetOrgPerson
  87. objectClass: user
  88. objectClass: posixAccount
  89. objectClass: goauthentik.io/ldap/user
  90. homeDirectory: /home/ak-outpost-7dc975f1d72e490ea98759961b273f59
  91. modifyTimestamp: 20260520085315Z

  93. # akadmin, users, arc.com
  94. dn: cn=akadmin,ou=users,dc=arc,dc=com
  95. pwdChangedTime: 20260520085715Z
  96. cn: akadmin
  97. gidNumber: 2004
  98. sn: authentik Default Admin
  99. ak-active: TRUE
  100. name: authentik Default Admin
  101. objectClass: top
  102. objectClass: person
  103. objectClass: organizationalPerson
  104. objectClass: inetOrgPerson
  105. objectClass: user
  106. objectClass: posixAccount
  107. objectClass: goauthentik.io/ldap/user
  108. homeDirectory: /home/akadmin
  109. createTimestamp: 20260520085321Z
  110. modifyTimestamp: 20260520085715Z
  111. ak-superuser: TRUE
  112. uid: 9210c20adcfd6a1bb0d05dba74a545a3acbf9a9fa3dc3de66ac52333047f45cc
  113. displayName: authentik Default Admin
  114. uidNumber: 2004
  115. memberOf: cn=authentik Admins,ou=groups,dc=arc,dc=com
  116. sAMAccountName: akadmin
  117. mail: tao.duan@arcadiasemi.com

  119. # dubo, users, arc.com
  120. dn: cn=dubo,ou=users,dc=arc,dc=com
  121. title:: 5YW25LuW
  122. source: python-faker-script
  123. modifyTimestamp: 20260522064209Z
  124. sAMAccountName: dubo
  125. homeDirectory: /home/dubo
  126. createTimestamp: 20260522064209Z
  127. displayName:: 5p2c5rOi
  128. mail: dubo@alibaba.com
  129. objectClass: top
  130. objectClass: person
  131. objectClass: organizationalPerson
  132. objectClass: inetOrgPerson
  133. objectClass: user
  134. objectClass: posixAccount
  135. objectClass: goauthentik.io/ldap/user
  136. uidNumber: 2031
  137. sn:: 5p2c5rOi
  138. ak-active: TRUE
  139. ak-superuser: FALSE
  140. cn: dubo
  141. name:: 5p2c5rOi
  142. pwdChangedTime: 20260522064209Z
  143. memberOf: cn=ceo,ou=groups,dc=arc,dc=com
  144. uid: 937dc57ce8dff66938a005a4f57b1a4637aab7fce649944a889ee4382dab3298
  145. gidNumber: 2031

  147. # guoyan, users, arc.com
  148. dn: cn=guoyan,ou=users,dc=arc,dc=com
  149. title:: 6J6N6LWE57uP55CGL+iejei1hOS4u+euoQ==
  150. source: python-faker-script
  151. uid: 8efa6bbee72104ea6bfdd4c588af2cb4f5b837c000fb9564b0918b6f00fc5abd
  152. name:: 6YOt5bKp
  153. gidNumber: 2029
  154. homeDirectory: /home/guoyan
  155. pwdChangedTime: 20260522064208Z
  156. createTimestamp: 20260522064208Z
  157. ak-active: TRUE
  158. ak-superuser: FALSE
  159. memberOf: cn=finance,ou=groups,dc=arc,dc=com
  160. uidNumber: 2029
  161. sn:: 6YOt5bKp
  162. modifyTimestamp: 20260522064208Z
  163. sAMAccountName: guoyan
  164. displayName:: 6YOt5bKp
  165. mail: guoyan@alibaba.com
  166. objectClass: top
  167. objectClass: person
  168. objectClass: organizationalPerson
  169. objectClass: inetOrgPerson
  170. objectClass: user
  171. objectClass: posixAccount
  172. objectClass: goauthentik.io/ldap/user
  173. cn: guoyan

  175. # liunan, users, arc.com
  176. dn: cn=liunan,ou=users,dc=arc,dc=com
  177. title:: 56m65LmY5Lq65ZGY
  178. source: python-faker-script
  179. displayName:: 5YiY5qWg
  180. homeDirectory: /home/liunan
  181. pwdChangedTime: 20260522064204Z
  182. modifyTimestamp: 20260522064204Z
  183. ak-active: TRUE
  184. ak-superuser: FALSE
  185. memberOf: cn=HR,ou=groups,dc=arc,dc=com
  186. cn: liunan
  187. uid: 21d36a66af3e3a14a87fe7407786e283bd5d9e0a768082054fa42a19e7ea037d
  188. mail: liunan@alibaba.com
  189. sn:: 5YiY5qWg
  190. name:: 5YiY5qWg
  191. uidNumber: 2012
  192. sAMAccountName: liunan
  193. objectClass: top
  194. objectClass: person
  195. objectClass: organizationalPerson
  196. objectClass: inetOrgPerson
  197. objectClass: user
  198. objectClass: posixAccount
  199. objectClass: goauthentik.io/ldap/user
  200. gidNumber: 2012
  201. createTimestamp: 20260522064204Z

  203. # groups, arc.com
  204. dn: ou=groups,dc=arc,dc=com
  205. distinguishedName: ou=groups,dc=arc,dc=com
  206. objectClass: top
  207. objectClass: nsContainer
  208. commonName: groups

  210. # HR, groups, arc.com
  211. dn: cn=HR,ou=groups,dc=arc,dc=com
  212. member: cn=liunan,ou=users,dc=arc,dc=com
  213. cn: HR
  214. uid: 4ae42a73-607f-4f7f-a02e-8436955e55df
  215. sAMAccountName: HR
  216. gidNumber: 103547
  217. ak-superuser: false
  218. objectClass: group
  219. objectClass: groupOfUniqueNames
  220. objectClass: groupOfNames
  221. objectClass: goauthentik.io/ldap/group
  222. objectClass: posixGroup

  224. # authentik Admins, groups, arc.com
  225. dn: cn=authentik Admins,ou=groups,dc=arc,dc=com
  226. uid: 25f61600-efb4-478a-a0ca-b270ad8b8d9c
  227. sAMAccountName: authentik Admins
  228. gidNumber: 54459
  229. ak-superuser: true
  230. objectClass: group
  231. objectClass: groupOfUniqueNames
  232. objectClass: groupOfNames
  233. objectClass: goauthentik.io/ldap/group
  234. objectClass: posixGroup
  235. member: cn=akadmin,ou=users,dc=arc,dc=com
  236. cn: authentik Admins

  238. # authentik Read-only, groups, arc.com
  239. dn: cn=authentik Read-only,ou=groups,dc=arc,dc=com
  240. notes:: QW4gZ3JvdXAgd2l0aCBhbiBhdXRvLWdlbmVyYXRlZCByb2xlIHRoYXQgYWxsb3dzIHJlYW
  241. Qtb25seSBwZXJtaXNzaW9ucyBvbiBhbGwgb2JqZWN0cy4K
  242. cn: authentik Read-only
  243. uid: 965fb543-48f1-4176-aa3d-a3f874209578
  244. sAMAccountName: authentik Read-only
  245. gidNumber: 23988
  246. ak-superuser: false
  247. objectClass: group
  248. objectClass: groupOfUniqueNames
  249. objectClass: groupOfNames
  250. objectClass: goauthentik.io/ldap/group
  251. objectClass: posixGroup

  253. # ceo, groups, arc.com
  254. dn: cn=ceo,ou=groups,dc=arc,dc=com
  255. gidNumber: 51063
  256. ak-superuser: false
  257. objectClass: group
  258. objectClass: groupOfUniqueNames
  259. objectClass: groupOfNames
  260. objectClass: goauthentik.io/ldap/group
  261. objectClass: posixGroup
  262. member: cn=dubo,ou=users,dc=arc,dc=com
  263. cn: ceo
  264. uid: 236822ae-a219-4586-bbdb-7ca8f9216fcb
  265. sAMAccountName: ceo

  267. # devops, groups, arc.com
  268. dn: cn=devops,ou=groups,dc=arc,dc=com
  269. cn: devops
  270. uid: e77616b9-ee85-4fdd-820a-eb9e8cd2db5e
  271. sAMAccountName: devops
  272. gidNumber: 34766
  273. ak-superuser: false
  274. objectClass: group
  275. objectClass: groupOfUniqueNames
  276. objectClass: groupOfNames
  277. objectClass: goauthentik.io/ldap/group
  278. objectClass: posixGroup

  280. # finance, groups, arc.com
  281. dn: cn=finance,ou=groups,dc=arc,dc=com
  282. member: cn=guoyan,ou=users,dc=arc,dc=com
  283. cn: finance
  284. uid: 5c7b0a6c-e2ce-445f-9665-ca85361cad6c
  285. sAMAccountName: finance
  286. gidNumber: 16292
  287. ak-superuser: false
  288. objectClass: group
  289. objectClass: groupOfUniqueNames
  290. objectClass: groupOfNames
  291. objectClass: goauthentik.io/ldap/group
  292. objectClass: posixGroup

  294. # it, groups, arc.com
  295. dn: cn=it,ou=groups,dc=arc,dc=com
  296. cn: it
  297. uid: db772297-f8e8-46a1-9c66-b650676b125f
  298. sAMAccountName: it
  299. gidNumber: 33171
  300. ak-superuser: false
  301. objectClass: group
  302. objectClass: groupOfUniqueNames
  303. objectClass: groupOfNames
  304. objectClass: goauthentik.io/ldap/group
  305. objectClass: posixGroup

  307. # maketing, groups, arc.com
  308. dn: cn=maketing,ou=groups,dc=arc,dc=com
  309. uid: a8cf1d34-050e-499d-9fe0-6e7150f0da4e
  310. sAMAccountName: maketing
  311. gidNumber: 26438
  312. ak-superuser: false
  313. objectClass: group
  314. objectClass: groupOfUniqueNames
  315. objectClass: groupOfNames
  316. objectClass: goauthentik.io/ldap/group
  317. objectClass: posixGroup
  318. cn: maketing

  320. # product-plan, groups, arc.com
  321. dn: cn=product-plan,ou=groups,dc=arc,dc=com
  322. uid: 00bf3bad-e86b-40a3-8c4a-81fa6e52e6cc
  323. sAMAccountName: product-plan
  324. gidNumber: 103293
  325. ak-superuser: false
  326. objectClass: group
  327. objectClass: groupOfUniqueNames
  328. objectClass: groupOfNames
  329. objectClass: goauthentik.io/ldap/group
  330. objectClass: posixGroup
  331. cn: product-plan

  333. # tech, groups, arc.com
  334. dn: cn=tech,ou=groups,dc=arc,dc=com
  335. cn: tech
  336. uid: c5824e2e-064f-4930-9b1e-e61a7fa12536
  337. sAMAccountName: tech
  338. gidNumber: 30253
  339. ak-superuser: false
  340. objectClass: group
  341. objectClass: groupOfUniqueNames
  342. objectClass: groupOfNames
  343. objectClass: goauthentik.io/ldap/group
  344. objectClass: posixGroup

  346. # virtual-groups, arc.com
  347. dn: ou=virtual-groups,dc=arc,dc=com
  348. distinguishedName: ou=virtual-groups,dc=arc,dc=com
  349. objectClass: top
  350. objectClass: nsContainer
  351. commonName: virtual-groups

  353. # ak-outpost-5c571a6db0554d1dad11b1ffb4d9fd4e, virtual-groups, arc.com
  354. dn: cn=ak-outpost-5c571a6db0554d1dad11b1ffb4d9fd4e,ou=virtual-groups,dc=arc,dc
  355. =com
  356. sAMAccountName: ak-outpost-5c571a6db0554d1dad11b1ffb4d9fd4e
  357. gidNumber: 2005
  358. ak-superuser: false
  359. objectClass: group
  360. objectClass: groupOfUniqueNames
  361. objectClass: groupOfNames
  362. objectClass: goauthentik.io/ldap/group
  363. objectClass: posixGroup
  364. objectClass: goauthentik.io/ldap/virtual-group
  365. member: cn=ak-outpost-5c571a6db0554d1dad11b1ffb4d9fd4e,ou=users,dc=arc,dc=com
  366. cn: ak-outpost-5c571a6db0554d1dad11b1ffb4d9fd4e
  367. uid: b3ae2bdc44a80225b0008def0f65298d2ca60a3114b666d30411e0231e46e65d

  369. # ak-outpost-7dc975f1d72e490ea98759961b273f59, virtual-groups, arc.com
  370. dn: cn=ak-outpost-7dc975f1d72e490ea98759961b273f59,ou=virtual-groups,dc=arc,dc
  371. =com
  372. member: cn=ak-outpost-7dc975f1d72e490ea98759961b273f59,ou=users,dc=arc,dc=com
  373. cn: ak-outpost-7dc975f1d72e490ea98759961b273f59
  374. uid: a55fb72010340fd2f693ddacad2649c6ebaa90d3c7f23e59cfb558ffea2dd879
  375. sAMAccountName: ak-outpost-7dc975f1d72e490ea98759961b273f59
  376. gidNumber: 2002
  377. ak-superuser: false
  378. objectClass: group
  379. objectClass: groupOfUniqueNames
  380. objectClass: groupOfNames
  381. objectClass: goauthentik.io/ldap/group
  382. objectClass: posixGroup
  383. objectClass: goauthentik.io/ldap/virtual-group

  385. # akadmin, virtual-groups, arc.com
  386. dn: cn=akadmin,ou=virtual-groups,dc=arc,dc=com
  387. uid: 9210c20adcfd6a1bb0d05dba74a545a3acbf9a9fa3dc3de66ac52333047f45cc
  388. sAMAccountName: akadmin
  389. gidNumber: 2004
  390. ak-superuser: false
  391. objectClass: group
  392. objectClass: groupOfUniqueNames
  393. objectClass: groupOfNames
  394. objectClass: goauthentik.io/ldap/group
  395. objectClass: posixGroup
  396. objectClass: goauthentik.io/ldap/virtual-group
  397. member: cn=akadmin,ou=users,dc=arc,dc=com
  398. cn: akadmin

  400. # dubo, virtual-groups, arc.com
  401. dn: cn=dubo,ou=virtual-groups,dc=arc,dc=com
  402. ak-superuser: false
  403. objectClass: group
  404. objectClass: groupOfUniqueNames
  405. objectClass: groupOfNames
  406. objectClass: goauthentik.io/ldap/group
  407. objectClass: posixGroup
  408. objectClass: goauthentik.io/ldap/virtual-group
  409. member: cn=dubo,ou=users,dc=arc,dc=com
  410. cn: dubo
  411. uid: 937dc57ce8dff66938a005a4f57b1a4637aab7fce649944a889ee4382dab3298
  412. sAMAccountName: dubo
  413. gidNumber: 2031

  415. # guoyan, virtual-groups, arc.com
  416. dn: cn=guoyan,ou=virtual-groups,dc=arc,dc=com
  417. cn: guoyan
  418. uid: 8efa6bbee72104ea6bfdd4c588af2cb4f5b837c000fb9564b0918b6f00fc5abd
  419. sAMAccountName: guoyan
  420. gidNumber: 2029
  421. ak-superuser: false
  422. objectClass: group
  423. objectClass: groupOfUniqueNames
  424. objectClass: groupOfNames
  425. objectClass: goauthentik.io/ldap/group
  426. objectClass: posixGroup
  427. objectClass: goauthentik.io/ldap/virtual-group
  428. member: cn=guoyan,ou=users,dc=arc,dc=com

  430. # liunan, virtual-groups, arc.com
  431. dn: cn=liunan,ou=virtual-groups,dc=arc,dc=com
  432. ak-superuser: false
  433. objectClass: group
  434. objectClass: groupOfUniqueNames
  435. objectClass: groupOfNames
  436. objectClass: goauthentik.io/ldap/group
  437. objectClass: posixGroup
  438. objectClass: goauthentik.io/ldap/virtual-group
  439. member: cn=liunan,ou=users,dc=arc,dc=com
  440. cn: liunan
  441. uid: 21d36a66af3e3a14a87fe7407786e283bd5d9e0a768082054fa42a19e7ea037d
  442. sAMAccountName: liunan
  443. gidNumber: 2012

  445. # search result
  446. search: 2
  447. result: 0 Success

  449. # numResponses: 27
  450. # numEntries: 26

复制代码

解决该疑问，预计可以帮助到 18048 人！

回帖即可获得
2S豆
，被楼主采纳即奖励20S豆+10分钟内回帖奖励10S豆 [已过期] ，了解更多S豆奖励信息

完善手机号和公司名称，让服务更省心更便捷！立即完善
土豆土豆胡萝卜  发表于 2026-8-7 11:32
  
根目录里面没有小的组织架构ou吗
王老师  发表于 2026-8-7 17:10
  
确保aTrust设备与Authentik服务器之间网络互通，端口（默认389）可达
王老师  发表于 2026-8-7 17:11
  
准备好Authentik中一个用于LDAP查询的专用服务账号（Bind DN）及密码
王老师  发表于 2026-8-7 17:14
  
直接登录AC管理界面，进入应用识别或策略配置页面，将应用列表截屏，然后粘贴到Word或Excel里交给各部门核对。虽然不能直接生成表格，但胜在速度最快，能解燃眉之急。
发表新帖 收藏 回复本帖
分享

等我来答：

换一批

发表新帖
热门标签
全部标签>
故障笔记
安装部署配置
信服课堂视频
每日一问
功能体验
技术笔记
纪元平台
标准化排查
新版本体验
排障那些事
2025年技术争霸赛
GIF动图学习
问题分析处理
每日一记
测试报告
专家分享
每周精选
排障笔记本
【 社区to talk】
王者破雾峡谷
技术盲盒
文档捉虫
2024年技术争霸赛
社区新周刊
安全效果
行业实践
知识大闯关
大规模VMware迁移替代
产品连连看
畅聊IT
答题自测
专家问答
技术圆桌
在线直播
MVP
网络基础知识
升级
安全攻防
上网策略
日志审计
流量管理
运维工具
用户认证
原创分享
解决方案
sangfor周刊
VPN 对接
项目案例
SANGFOR资讯
技术顾问
信服故事
SDP百科
功能咨询
终端接入
授权
设备维护
资源访问
地址转换
虚拟机
存储
迁移
产品预警公告
玩转零信任
S豆商城资讯
技术争霸赛
「智能机器人」
追光者计划
2023技术争霸赛专题
卧龙计划
华北区拉练
天逸直播
以战代练
秒懂零信任
技术晨报
平台使用
山东区技术晨报
齐鲁TV
华北区交付直播
北京区每日一练
场景专题
西北区每日一问
高手请过招
升级&主动服务
高频问题集锦
POC测试案例
全能先锋系列
云化安全能力
专家说
热门活动
产品动态
产品解析
关键解决方案
声音值千金
工具体验官
产品知识周周练
产品体验官
有一说一
VMware替换
课后茶话社
案例实践挑战
破雾实践案例
转盘
任务
商城
勋章
成长计划

本版版主

下一代防火墙
4
9
0

发帖

粉丝

关注

小鱼学安全
702
20
36

发帖

粉丝

关注

年度之星

本版热帖

本版达人