Authentik - struggling with Avatars

[sdelnevo]

Hi

Firstly I would like to say a big thank you for this amazing software.

I'm currently running your latest build version 0.5.1-alpha, and have integrated this into Authentik following your guide in the example-configs, the only issue I am facing is not being able to pull in users Avatars when they connect.

within Authentik, in system - settings in the avatars section, the description says

"An attribute path like attributes.something.avatar, which can be used in combination with the file field to allow users to upload custom avatars for themselves."

Does anyone know what i would enter here to pull in the avatar?

I have tried

attributes.uid.avatar
uid.avatar
avatar

with no luck

sorry if this is a very simple question, but this is the first time I have tried adding a attribute and I'm a little confused

Kind regards

Steve

[jakob42]

The avatar in lldap is in an attribute named jpegPhoto, maybe that helps

[nitnelave]

Hey, welcome!

Can you share the documentation link you're following? I'm looking at https://docs.goauthentik.io/integrations/sources/ldap/ and there's no mention of avatars.

I think there's a possibility that they don't support "inline" avatars (i.e. the jpeg photo itself is stored in the LDAP attribute), but instead expect an avatar URL (e.g. gravatar).

The avatar attribute is called either avatar or, equivalently, jpegPhoto (same thing)

[sdelnevo]

Hi Guys

many thanks for the amazingly quick replies

i have tried jpegPhoto in the format i used in the original post but still no joy

the link to the documentation I'm following is here

https://docs.goauthentik.io/docs/installation/configuration#authentik_avatars

not sure its related, but i have just noticed that the user avatars that have been uploaded are not showing in the web interface,

kind regards

Steve

edit updated the link

[nitnelave]

If you log in (e.g. as admin) to the LLDAP web interface, then you navigate to a user's profile, you don't see their avatar? (The avatars not showing up in the top right when you log in are a known shortcoming, but they should show up in the user details).

Note that the avatars should be valid JPEG photos (and the server should refuse any invalid photos).

The docs you linked are not LDAP-specific, so I suspect I was right earlier, they don't support "inline" photos. Maybe ask their community, they might prove me wrong!

[sdelnevo]

Hi

your correct, when login into Authentik as a user, no avatar is shown in the top right
Also no avatar, first or last name is shown when viewing the users profile within LLDAP, these where visible in the stable version

I will reach out to the Authentik community to see if this is possible

Kind regards

Steve

[nitnelave]

Wait, before you reach out to them, let's figure out the LLDAP side: if you query LLDAP with the lldap-cli, can you see the first/last name and avatar?

[sdelnevo]

Hi

sorry to be a pain, but how would i do that, im running LLDAP in portainer
kind regards

Steve

[nitnelave]

With https://github.com/Zepmann/lldap-cli, you can point it to your LLDAP URL.

[sdelnevo]

Hi

Many thanks for the link, i will have a go at that and get back to you

Steve

[sdelnevo]

Hi

This is where my inexperience comes in lol

looking at lldap-cli im completely lost. I used the templates from pi-hosted to install LLDAP and Authentik, on my Raspberry Pi so I am completely lost on how to install lldap-cli

I realise that this discussion is now getting completely off topic, so please feel free to close this

Many thanks
Kind regards

Steve

[nitnelave]

lldap-cli is just a bash script, you can just download it from the repo and run it as is. Check the readme, you just need to log in and put the JWT in the env variables first, then you can query the repo.

[sdelnevo]

Hi

LOL I'm going to very soon start to really embarrass myself , I'm going to have to look into bash scripts as I've never dealt with these before, I've downloaded it, but have no idea how to run it,

I've read the read me 3 times now LOL and it makes no sense to me at all

Please except my apologies as I have clearly bitten off more than I can chew :)

kind regards

Steve

[nitnelave]

We all have to start from somewhere :)

You can do bash lldap_cli other_arguments, or set the executable bit with chmod and just run ./lldap_cli

[sdelnevo]

Hi

Ok so I'm guessing this needs to be run from a terminal on Linux? if so i will have to try again later today as currently i only have access to a windows PC

many thanks for the help, and for the understanding

will let you know how it goes

Kind regards

Steve

[nitnelave]

Well, if you have LLDAP running, you have a linux system with bash :)
If you can open a shell session in the LLDAP container, you can get the lldap-cli tool from there and run it inside the container.

[sdelnevo]

Hi

I have downloaded the lldap-cli when connected to the container console in portainer

When running lldap-cli login I cannot log in using the admin account details

so I’m struggling to get further,

I am trying to log in with the admin account and password set in the lldap-config.toml file

I will keep trying

kind regards

Steve

[nitnelave]

Once inside the container (assuming that it's also running LLDAP), you can run something like:
eval $(lldap-cli -D admin -w abcd1234 -H http://localhost:17170 login)

If that works, you can then run:
lldap-cli user attribute values MY_USER first_name to check if MY_USER has a first_name set.

[sdelnevo]

Hi

I must have done something really silly as now when I try that comment I get

lldap-cli command not found

I think what I’m going to do, is delete the lldap container completely and redeploy it on another raspi pi that I have as a spare

im concerned that I’m starting to take your valuable time up

kind regards

steve

[nitnelave]

Try with ./lldap-cli :D

[nitnelave]

You can also join the Discord for a faster back-and-forth.
And don't worry about taking up my time, I'll be the judge of that (and stop answering you :p). As you can see, it hasn't happened yet!

[sdelnevo]

i tried ./lldap-cli

and im getting permission denied

your very kind to help, i will defiantly join the discord

kind regards

Steve

[nitnelave]

We're getting closer! Either bash ./lldap-cli or a more permanent chmod +x lldap-cli once, and then just ./lldap-cli will work.

[sdelnevo]

Hi

ok

i ran chmod +x lldap-cli

now i get

./lldap-cli
./lldap-cli: line 8: syntax error near unexpected token newline' ./lldap-cli: line 8: '

I have made a right mess of this lol

god im so sorry

Steve

[nitnelave]

... How? Did you edit the file?

Let's talk on discord, I think this needs detailed attention

[sdelnevo]

thank you, i have to go to work shortly, i will join discord when im back and get in touch via that

thank you so much for the help so far, its very much appriciated

kind regards

Steve

[sdelnevo]

Hi
Raised the question on discord this morning, you’ve answered there
Many thanks

kind regards

Steve