crowdsecurity/crowdsec · error

allowed_ou configuration contains invalid empty string

Error message

allowed_ou configuration contains invalid empty string

What it means

setAllowedOu validates the allowed_ou TLS auth configuration list before use. An empty string entry in the list is rejected because an empty OrganizationalUnit would make OU matching meaningless/over-permissive, so TLSAuth construction (NewTLSAuth) fails.

Source

Thrown at pkg/apiserver/middlewares/v1/tls_auth.go:75

		revokedByCRL, checkedByCRL := ta.crlChecker.isRevokedBy(cert, issuer)
		couldCheck = couldCheck && checkedByCRL

		if revokedByCRL && checkedByCRL {
			return errors.New("certificate revoked by CRL"), couldCheck
		}
	}

	return nil, couldCheck
}

func (ta *TLSAuth) setAllowedOu(allowedOus []string) error {
	uniqueOUs := make(map[string]struct{})

	for _, ou := range allowedOus {
		// disallow empty ou
		if ou == "" {
			return errors.New("allowed_ou configuration contains invalid empty string")
		}

		if _, exists := uniqueOUs[ou]; exists {
			ta.logger.Warningf("dropping duplicate ou %s", ou)
			continue
		}

		uniqueOUs[ou] = struct{}{}

		ta.AllowedOUs = append(ta.AllowedOUs, ou)
	}

	return nil
}

func (ta *TLSAuth) checkAllowedOU(ous []string) error {
	for _, ou := range ous {
		if slices.Contains(ta.AllowedOUs, ou) {

View on GitHub (pinned to 909b515798)

Solutions

1. Open the api.server.tls config section and remove the empty string element from allowed_ou
2. If a value comes from a template/variable, ensure it is set or skip the entry when empty
3. Restart CrowdSec after fixing the config

Example fix

// before (config.yaml)
tls:
  allowed_ou:
    - crowdsec
    - ""
// after
tls:
  allowed_ou:
    - crowdsec

// validate config before handing to NewTLSAuth
for _, ou := range cfg.TLS.AllowedOU {
    if strings.TrimSpace(ou) == "" {
        return errors.New("allowed_ou contains an empty entry")
    }
}

When it happens

Trigger: NewTLSAuth is given an allowed_ous/allowed_ou slice containing "", typically parsed from the API server's tls.allowed_ou config list.

Common situations: Trailing comma in a YAML list item or a hand-edited config producing an empty element; environment/config templating that expands an unset variable to an empty string.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• unknown TLS client_verification value: %s
• path must start with /
• basic_auth is selected, but basic_auth is not provided
• basic_auth is selected, but username is not provided
• basic_auth is selected, but password is not provided

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/1b921b32f1113fb5. Report an issue: GitHub.