Add property mailalias mapping

authentik/blueprint-ldap.yaml

@@ -8,6 +8,15 @@ data:
     metadata:
       name: LDAP Provider
     entries:
+      - model: authentik_providers_ldap.ldapprovidermapping
+        id: ldap-mail-aliases-mapping
+        state: present
+        identifiers:
+          name: "Mail Aliases"
+        attrs:
+          name: "Mail Aliases"
+          expression: |
+            return {"mailAlternativeAddress": list(request.user.attributes.get("mailAliases", []))}
       - model: authentik_providers_ldap.ldapprovider
         id: ldap-provider
         state: present
@@ -21,6 +30,8 @@ data:
           bind_mode: cached
           search_mode: cached
           mfa_support: false
+          extra_property_mappings:
+            - !KeyOf ldap-mail-aliases-mapping
       - model: authentik_core.application
         id: ldap-app
         state: present

nix-infra-machine/nodes/node001.nix

@@ -165,14 +165,15 @@
         bind.auth.method = "lookup";
 
         filter = {
-          name = "(&(objectClass=user)(|(cn=?)(mail=?)))";
-          email = "(&(objectClass=user)(mail=?))";
+          name = "(&(objectClass=user)(|(cn=?)(mail=?)(mailAlternativeAddress=?)))";
+          email = "(&(objectClass=user)(|(mail=?)(mailAlternativeAddress=?)))";
         };
 
         attributes = {
           name = "cn";
           class = "objectClass";
           email = "mail";
+          email-alias = "mailAlternativeAddress";
           groups = "memberOf";
         };
       };