Is your feature request related to a problem?

I'm always frustrated when syncing users and groups from a Novell
eDirectory LDAP source fails with:

ldap3.core.exceptions.LDAPAttributeError: invalid attribute type distinguishedName

This happens because authentik/sources/ldap/sync/users.py and
sync/groups.py request ALL_OPERATIONAL_ATTRIBUTES in the LDAP search,
and sync/membership.py explicitly requests LDAP_DISTINGUISHED_NAME
("distinguishedName") as an attribute. Novell eDirectory does not
expose distinguishedName as a queryable operational attribute (unlike
Active Directory or OpenLDAP), so the search is rejected outright and
the entire sync fails.

Describe the solution you'd like

I'd like authentik to have a way to sync against Novell eDirectory
without failing, ideally by:

1. Not requesting ALL_OPERATIONAL_ATTRIBUTES unconditionally in
   sync/users.py and sync/groups.py, or making it configurable per
   LDAP Source.
2. In sync/membership.py, not requiring distinguishedName as an
   explicit attribute request, since authentik already constructs
   the DN from the search result envelope elsewhere
   (properties.setdefault("attributes", {})[LDAP_DISTINGUISHED_NAME] = dn).

This would let eDirectory-backed sources sync successfully without
custom patches.

Describe alternatives that you've considered

I've tried this but currently run three local patches on top of the
stock images that we have to reapply on every authentik update:

1. Remove ALL_OPERATIONAL_ATTRIBUTES from the attributes=[...] list
   passed to search_paginator() in sync/users.py and sync/groups.py.
2. In sync/membership.py, change:
   attributes = [self._source.object_uniqueness_field, LDAP_DISTINGUISHED_NAME]
   to:
   attributes = [self._source.object_uniqueness_field]

This works reliably for our ~840 users / 70+ groups synced from
eDirectory, but isn't upgrade-safe.

Additional context

Also note that this is common in German school IT environments
running Novell paedML/eDirectory (ZCM-managed school networks).
Happy to test a proposed fix against our environment if useful.

authentik version: 2026.5.x
Deployment: docker-compose
LDAP Source: Novell eDirectory