Permissions based on OU with LDAP #2674

New Issue

OVERLORD · 2026-02-05T04:45:51+03:00

OVERLORD commented

2026-02-05 04:45:51 +03:00

Originally created by @usr-bin-urxvt on GitHub (Feb 26, 2022).

Attempted Debugging

I have read the debugging page

Searched GitHub Issues

I have searched GitHub for the issue.

Describe the Scenario

Currently I am using the following settings and have to add the group to many users:

LDAP_USER_TO_GROUPS=true
LDAP_GROUP_ATTRIBUTE="memberOf"
LDAP_REMOVE_FROM_GROUPS=false

But our permission system is based on OUs rather than groups, so for other services I use the following settings:
AUTH_LDAP_GROUP_SEARCH = "LDAPSearch('dc=corp,dc=com', ldap.SCOPE_SUBTREE,'(objectClass=group)')"
AUTH_LDAP_GROUP_TYPE = NestedGroupOfNamesType

Is it possible to also use these settings for assigning roles/permissions? I want the "IT Department" OU (with the external auth ID of "it-department" assigned) to work with roles.

Exact BookStack Version

v21.12.5

Log Content

No response

PHP Version

8.0

Hosting Environment

Ubuntu 20.04, installed using official guide.

Originally created by @usr-bin-urxvt on GitHub (Feb 26, 2022). ### Attempted Debugging - [X] I have read the debugging page ### Searched GitHub Issues - [X] I have searched GitHub for the issue. ### Describe the Scenario Currently I am using the following settings and have to add the group to many users: LDAP_USER_TO_GROUPS=true LDAP_GROUP_ATTRIBUTE="memberOf" LDAP_REMOVE_FROM_GROUPS=false But our permission system is based on OUs rather than groups, so for other services I use the following settings: AUTH_LDAP_GROUP_SEARCH = "LDAPSearch('dc=corp,dc=com', ldap.SCOPE_SUBTREE,'(objectClass=group)')" AUTH_LDAP_GROUP_TYPE = NestedGroupOfNamesType Is it possible to also use these settings for assigning roles/permissions? I want the "IT Department" OU (with the external auth ID of "it-department" assigned) to work with roles. ### Exact BookStack Version v21.12.5 ### Log Content _No response_ ### PHP Version 8.0 ### Hosting Environment Ubuntu 20.04, installed using official guide.

OVERLORD added the 🐕 Support label 2026-02-05 04:45:51 +03:00

OVERLORD closed this issue

2026-02-05 04:45:53 +03:00

OVERLORD commented

2026-02-05 04:45:59 +03:00

@ssddanbrown commented on GitHub (Feb 28, 2022):

Hi @usr-bin-urxvt,
We don't support any kind of LDAP group sync outside of the memberOf style groups system.
From what I've seen this is generally the standard for LDAP managed groups?
I wouldn't really be looking to extend our support in this area any further since adding edge-case auth features can built significant maintenance and support burden.

If it's just one group that you want to limit access to, you can often just update the LDAP_USER_FILTER.

If you have some dev skills available, we do have a logical theme system where you could hook into login events to potentially run custom functionality.

@ssddanbrown commented on GitHub (Feb 28, 2022): Hi @usr-bin-urxvt, We don't support any kind of LDAP group sync outside of the `memberOf` style groups system. From what I've seen this is generally the standard for LDAP managed groups? I wouldn't really be looking to extend our support in this area any further since adding edge-case auth features can built significant maintenance and support burden. If it's just one group that you want to limit access to, you can often just update the `LDAP_USER_FILTER`. If you have some dev skills available, we do have a [logical theme system](https://github.com/BookStackApp/BookStack/blob/development/dev/docs/logical-theme-system.md) where you could hook into login events to potentially run custom functionality.

OVERLORD commented

2026-02-05 04:46:04 +03:00

@usr-bin-urxvt commented on GitHub (Feb 28, 2022):

Thank you for the quick reply.

@usr-bin-urxvt commented on GitHub (Feb 28, 2022): Thank you for the quick reply.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/BookStack#2674