starred/BookStack
1
0
Fork 0
mirror of https://github.com/BookStackApp/BookStack.git synced 2026-02-05 00:29:48 +03:00
Code Issues 305 Packages Projects Releases 10 Wiki Activity

Sync a specific AD Group #1555

New Issue
Closed
opened 2026-02-05 01:13:16 +03:00 by OVERLORD · 8 comments
OVERLORD commented 2026-02-05 01:13:16 +03:00
Owner
Copy Link

Originally created by @Buliwif on GitHub (Feb 26, 2020).

Hi,
Is there a way to sync a specific group from AD ?
I think about something like this :
LDAP_BASE_DN=CN=BookStack_Group,OU=example,DC=example,DC=example,DC=example

For the moment I synchronise an OU and it works.
I read documentation but I'm not sure to understand everything...
If it's possible can You show me an example please ?

Originally created by @Buliwif on GitHub (Feb 26, 2020). Hi, Is there a way to sync a specific group from AD ? I think about something like this : LDAP_BASE_DN=CN=BookStack_Group,OU=example,DC=example,DC=example,DC=example For the moment I synchronise an OU and it works. I read documentation but I'm not sure to understand everything... If it's possible can You show me an example please ?
OVERLORD commented 2026-02-05 01:13:21 +03:00
Author
Owner
Copy Link

@kanlas-net commented on GitHub (Feb 26, 2020):

You can use ldap search filter
LDAP_USER_FILTER=(&(objectClass=user)(sAMAccountname={0})(memberOf=cn=BookStack_Group,ou=example,DC=example,DC=example))

@kanlas-net commented on GitHub (Feb 26, 2020): You can use ldap search filter LDAP_USER_FILTER=(&(objectClass=user)(sAMAccountname={0})(memberOf=cn=BookStack_Group,ou=example,DC=example,DC=example))
OVERLORD commented 2026-02-05 01:13:22 +03:00
Author
Owner
Copy Link

@Buliwif commented on GitHub (Feb 26, 2020):

Thank you ! it works like a charm.
Just another question please, it seems that all user of this group has no roles. And it disable the local admin account.

I understand that it is possible to synchronize a ADgroup with a BookStackrole, how can I do with this configuration?

For now I got something like this :

LDAP_SERVER=example.domain.com:389
LDAP_BASE_DN="OU=BASE,OU=DC=example,DC=domain,DC=com"

LDAP_DN="CN=BookStackUser,OU=BASE,OU=DC=example,DC=domain,DC=com"
LDAP_PASS=blablabla

LDAP_USER_FILTER=(&(sAMAccountName=${user})(memberOf=cn=BookStack_Group,OU=BASE,OU=DC=example,DC=domain,DC=com))
LDAP_VERSION=3
LDAP_ID_ATTRIBUTE=BIN;objectGUID
@Buliwif commented on GitHub (Feb 26, 2020): Thank you ! it works like a charm. Just another question please, it seems that all user of this group has no roles. And it disable the local admin account. I understand that it is possible to synchronize a ADgroup with a BookStackrole, how can I do with this configuration? For now I got something like this : ``` LDAP_SERVER=example.domain.com:389 LDAP_BASE_DN="OU=BASE,OU=DC=example,DC=domain,DC=com" LDAP_DN="CN=BookStackUser,OU=BASE,OU=DC=example,DC=domain,DC=com" LDAP_PASS=blablabla LDAP_USER_FILTER=(&(sAMAccountName=${user})(memberOf=cn=BookStack_Group,OU=BASE,OU=DC=example,DC=domain,DC=com)) LDAP_VERSION=3 LDAP_ID_ATTRIBUTE=BIN;objectGUID ```
OVERLORD commented 2026-02-05 01:13:24 +03:00
Author
Owner
Copy Link

@kanlas-net commented on GitHub (Feb 26, 2020):

Check this documentation page, at the end you will find groups sync setup
https://www.bookstackapp.com/docs/admin/ldap-auth/

@kanlas-net commented on GitHub (Feb 26, 2020): Check this documentation page, at the end you will find groups sync setup https://www.bookstackapp.com/docs/admin/ldap-auth/
OVERLORD commented 2026-02-05 01:13:29 +03:00
Author
Owner
Copy Link

@Buliwif commented on GitHub (Feb 26, 2020):

Ok thank you. After multiples trials, it works fine
I already read this but I have some gaps in English ... so I misunderstood some things... sorry. Now it's good for this part.

A last questionplease :
this is good :

LDAP_USER_FILTER=(&(objectClass=user)(sAMAccountname={0})(memberOf=cn=BookStack_Group,ou=example,DC=example,DC=example))

But if I put an ADgroup called "TECHservice" inside the ADgroup "BookStack_Group", users insides "TECHservice" can't connect.
Is it a way to allow group inside group ?

@Buliwif commented on GitHub (Feb 26, 2020): Ok thank you. After multiples trials, it works fine I already read this but I have some gaps in English ... so I misunderstood some things... sorry. Now it's good for this part. A last questionplease : this is good : ``` LDAP_USER_FILTER=(&(objectClass=user)(sAMAccountname={0})(memberOf=cn=BookStack_Group,ou=example,DC=example,DC=example)) ``` But if I put an ADgroup called "TECHservice" inside the ADgroup "BookStack_Group", users insides "TECHservice" can't connect. Is it a way to allow group inside group ?
OVERLORD commented 2026-02-05 01:13:34 +03:00
Author
Owner
Copy Link

@ssddanbrown commented on GitHub (Feb 26, 2020):

@Buliwif Looks like this stack overflow result might help for that scenario:
https://stackoverflow.com/questions/6195812/ldap-nested-group-membership

LDAP_USER_FILTER=(&(objectClass=user)(sAMAccountname={0})(memberOf:1.2.840.113556.1.4.1941:=cn=BookStack_Group,ou=example,DC=example,DC=example))

Havn't got AD to test myself though.

@ssddanbrown commented on GitHub (Feb 26, 2020): @Buliwif Looks like this stack overflow result might help for that scenario: https://stackoverflow.com/questions/6195812/ldap-nested-group-membership ``` LDAP_USER_FILTER=(&(objectClass=user)(sAMAccountname={0})(memberOf:1.2.840.113556.1.4.1941:=cn=BookStack_Group,ou=example,DC=example,DC=example)) ``` Havn't got AD to test myself though.
OVERLORD commented 2026-02-05 01:13:36 +03:00
Author
Owner
Copy Link

@Buliwif commented on GitHub (Feb 28, 2020):

Hi, sorry for late response, I wasn't at work yesterday. I'll try it today and tell you if it's ok.
Thank you

@Buliwif commented on GitHub (Feb 28, 2020): Hi, sorry for late response, I wasn't at work yesterday. I'll try it today and tell you if it's ok. Thank you
OVERLORD commented 2026-02-05 01:13:38 +03:00
Author
Owner
Copy Link

@Buliwif commented on GitHub (Feb 28, 2020):

I just have to say : thank you very much.
So happy to use your product, it's really the best I tried.

@Buliwif commented on GitHub (Feb 28, 2020): I just have to say : thank you very much. So happy to use your product, it's really the best I tried.
OVERLORD commented 2026-02-05 01:13:40 +03:00
Author
Owner
Copy Link

@ssddanbrown commented on GitHub (Feb 28, 2020):

@Buliwif Thank you very much. Can you confirm if the above worked? Can this now be closed?

@ssddanbrown commented on GitHub (Feb 28, 2020): @Buliwif Thank you very much. Can you confirm if the above worked? Can this now be closed?
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
🎨 Design
📖 Docs Update
🐛 Bug
🐛 Bug
:cat2:🐈 Possible duplicate
💿 Database
☕ Open to discussion
💻 Front-End
🐕 Support
🚪 Authentication
🌍 Translations
🔌 API Task
🏭 Back-End
⛲ Upstream
🔨 Feature Request
🛠️ Enhancement
🛠️ Enhancement
🛠️ Enhancement
❤️ Happy feedback
🔒 Security
🔍 Pending Validation
💆 UX
📝 WYSIWYG Editor
🌔 Out of scope
🔩 API Request
:octocat: Admin/Meta
🖌️ View Customization
❓ Question
🚀 Priority
🛡️ Blocked
🚚 Export System
♿ A11y
🔧 Maintenance
> Markdown Editor
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/BookStack#1555
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?