From 91812829c624779ecfd7eb86d449fa3f84df99d1 Mon Sep 17 00:00:00 2001
From: Ruben Hensen <ruben.hensen@protonmail.com>
Date: Sun, 5 Apr 2026 22:36:44 +0200
Subject: [PATCH] Add property mailalias mapping

---
 authentik/blueprint-ldap.yaml       | 11 +++++++++++
 nix-infra-machine/nodes/node001.nix |  5 +++--
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/authentik/blueprint-ldap.yaml b/authentik/blueprint-ldap.yaml
index 50930e1..a05ea15 100644
--- a/authentik/blueprint-ldap.yaml
+++ b/authentik/blueprint-ldap.yaml
@@ -8,6 +8,15 @@ data:
     metadata:
       name: LDAP Provider
     entries:
+      - model: authentik_providers_ldap.ldapprovidermapping
+        id: ldap-mail-aliases-mapping
+        state: present
+        identifiers:
+          name: "Mail Aliases"
+        attrs:
+          name: "Mail Aliases"
+          expression: |
+            return {"mailAlternativeAddress": list(request.user.attributes.get("mailAliases", []))}
       - model: authentik_providers_ldap.ldapprovider
         id: ldap-provider
         state: present
@@ -21,6 +30,8 @@ data:
           bind_mode: cached
           search_mode: cached
           mfa_support: false
+          extra_property_mappings:
+            - !KeyOf ldap-mail-aliases-mapping
       - model: authentik_core.application
         id: ldap-app
         state: present
diff --git a/nix-infra-machine/nodes/node001.nix b/nix-infra-machine/nodes/node001.nix
index 38e498f..34a05a1 100644
--- a/nix-infra-machine/nodes/node001.nix
+++ b/nix-infra-machine/nodes/node001.nix
@@ -165,14 +165,15 @@
         bind.auth.method = "lookup";
 
         filter = {
-          name = "(&(objectClass=user)(|(cn=?)(mail=?)))";
-          email = "(&(objectClass=user)(mail=?))";
+          name = "(&(objectClass=user)(|(cn=?)(mail=?)(mailAlternativeAddress=?)))";
+          email = "(&(objectClass=user)(|(mail=?)(mailAlternativeAddress=?)))";
         };
 
         attributes = {
           name = "cn";
           class = "objectClass";
           email = "mail";
+          email-alias = "mailAlternativeAddress";
           groups = "memberOf";
         };
       };