Test of LDAP Property Mappings fails every time

[jorhett]

Describe the bug

Testing an LDAP property mapping doesn't work:

To Reproduce
Steps to reproduce the behavior:

1. Go to https://authentik.example.com/if/admin/#/core/property-mappings
2. Deselect 'Hide managed mappings'
3. Near 'authentik default LDAP Mapping: mail' click the test tube icon
4. Select a user
5. See error

Expected behavior

The test of the mapping should work.

Screenshots

Traceback (most recent call last):
  File "/authentik/core/models.py", line 969, in evaluate
    return evaluator.evaluate(self.expression)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/authentik/core/expression/evaluator.py", line 88, in evaluate
    return super().evaluate(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/authentik/lib/expression/evaluator.py", line 227, in evaluate
    raise exc
  File "authentik default LDAP Mapping: mail", line 5, in <module>
  File "authentik default LDAP Mapping: mail", line 3, in handler
builtins.NameError: name 'ldap' is not defined

Logs

No logs other than auth by existing session are generated during this event.

Version and Deployment (please complete the following information):

• authentik version: [e.g. 2021.8.5] 2024.12.3
• Deployment: [e.g. docker-compose, helm] podman quadlets

[rissson]

You need to fill the context of the test. Source property mappings in general receive data that can be used to create the user/group properties. That data needs to be faked when testing. We are planning to add example data that can be selected to make this process easier, but haven't gotten around to it. For now, you can set the context to something like:

dn: "uid=username,ou=users,dc=authentik,dc=company"
ldap:
  name: My User Name
  mail: test@authentik.company

For LDAP, the reference of attributes that are available can be found at https://docs.goauthentik.io/docs/users-sources/sources/protocols/ldap/#expression-data

[jorhett]

How would one know to do this? Couldn't you prefill the context in this situation?

The UI is not understandable to mean that the buttons enter example data... and it wouldn't hurt to have a posix entry. Something like this might be more readable

Example context data: Active Directory User | FreeIPA User | Active Directory Group