sources/ldap: don't sync ldap source when no property mappings are set

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

authentik/sources/ldap/signals.py

@@ -25,7 +25,14 @@ from authentik.stages.prompt.signals import password_validate
 # pylint: disable=unused-argument
 def sync_ldap_source_on_save(sender, instance: LDAPSource, **_):
     """Ensure that source is synced on save (if enabled)"""
-    if instance.enabled:
+    if not instance.enabled:
+        return
+    # Don't sync sources when they don't have any property mappings. This will only happen if:
+    # - the user forgets to set them or
+    # - the source is newly created, this is the first save event
+    #   and the mappings are created with an m2m event
+    if not instance.property_mappings.exists() or not instance.property_mappings_group.exists():
+        return
     for sync_class in [
         UserLDAPSynchronizer,
         GroupLDAPSynchronizer,

web/src/pages/sources/ldap/LDAPSourceForm.ts

@@ -162,7 +162,7 @@ export class LDAPSourceForm extends ModelForm<LDAPSource, string> {
                     </ak-form-element-horizontal>
                 </div>
             </ak-form-group>
-            <ak-form-group>
+            <ak-form-group ?expanded=${true}>
                 <span slot="header"> ${t`LDAP Attribute mapping`} </span>
                 <div slot="body" class="pf-c-form">
                     <ak-form-element-horizontal

web/src/pages/sources/ldap/LDAPSourceViewPage.ts

@@ -207,6 +207,7 @@ export class LDAPSourceViewPage extends LitElement {
                             </div>
                             <div class="pf-c-card__footer">
                                 <ak-action-button
+                                    class="pf-m-primary"
                                     .apiRequest=${() => {
                                         return new SourcesApi(DEFAULT_CONFIG)
                                             .sourcesLdapPartialUpdate({