LDAPS User Group #3292

New Issue

OVERLORD · 2026-02-05T06:16:27+03:00

OVERLORD commented

2026-02-05 06:16:27 +03:00

Originally created by @mschoon85 on GitHub (Oct 20, 2022).

Attempted Debugging

I have read the debugging page

Searched GitHub Issues

I have searched GitHub for the issue.

Describe the Scenario

Hello,

I'm trying to make sure a certain group has access to bookstack. For some reason it will only work when the user is directly in the OU and not in a group within the OU.

This works:
LDAP_BASE_DN="OU=Admins,OU=Users,DC=companyname,DC=com"

This does not work:
LDAP_BASE_DN="cn=G_Admin_Group,OU=Admins,OU=Users,DC=companyname,DC=com"

CN is the name of the group I'm trying to give access.

I'm also using the following other settings in the .env file:
LDAP_USER_FILTER=(&(sAMAccountName=${user}))
LDAP_VERSION=3
LDAP_ID_ATTRIBUTE=sAMAccountName
LDAP_USER_TO_GROUPS=true
LDAP_GROUP_ATTRIBUTE="memberOf"
LDAP_REMOVE_FROM_GROUPS=false

We need this to work before we can start using Bookstack company wide.

Kind regards and thank you in advance,

Michel

Exact BookStack Version

22.09.01

Log Content

No response

PHP Version

8.1.9

Hosting Environment

Windows Server 2022 using instructions on https://www.bookstackapp.com/docs/admin/installation/ ( Manual installation via GIT)

Originally created by @mschoon85 on GitHub (Oct 20, 2022). ### Attempted Debugging - [X] I have read the debugging page ### Searched GitHub Issues - [X] I have searched GitHub for the issue. ### Describe the Scenario Hello, I'm trying to make sure a certain group has access to bookstack. For some reason it will only work when the user is directly in the OU and not in a group within the OU. **This works:** LDAP_BASE_DN="OU=Admins,OU=Users,DC=companyname,DC=com" **This does not work:** LDAP_BASE_DN="cn=G_Admin_Group,OU=Admins,OU=Users,DC=companyname,DC=com" CN is the name of the group I'm trying to give access. I'm also using the following other settings in the .env file: LDAP_USER_FILTER=(&(sAMAccountName=${user})) LDAP_VERSION=3 LDAP_ID_ATTRIBUTE=sAMAccountName LDAP_USER_TO_GROUPS=true LDAP_GROUP_ATTRIBUTE="memberOf" LDAP_REMOVE_FROM_GROUPS=false We need this to work before we can start using Bookstack company wide. Kind regards and thank you in advance, Michel ### Exact BookStack Version 22.09.01 ### Log Content _No response_ ### PHP Version 8.1.9 ### Hosting Environment Windows Server 2022 using instructions on https://www.bookstackapp.com/docs/admin/installation/ ( Manual installation via GIT)

OVERLORD added the 🐕 Support label 2026-02-05 06:16:27 +03:00

OVERLORD closed this issue

2026-02-05 06:16:30 +03:00

OVERLORD commented

2026-02-05 06:16:32 +03:00

@ssddanbrown commented on GitHub (Oct 20, 2022):

Hi @mschoon85,

For some reason it will only work when the user is directly in the OU and not in a group within the OU

What exactly is meant by "it will only work" in this context? Is there an error? Does it just not validate login credentials? Does it just not sync groups?

The LDAP_BASE_DN should be a parent of any groups and users you want to match with, since this is the base of any searches across the LDAP system.
To specific filter/narrow user searches you could instead update the LDAP_USER_FILTER value so it only returns the users you want to allow access.

@ssddanbrown commented on GitHub (Oct 20, 2022): Hi @mschoon85, > For some reason it will only work when the user is directly in the OU and not in a group within the OU What exactly is meant by "it will only work" in this context? Is there an error? Does it just not validate login credentials? Does it just not sync groups? The `LDAP_BASE_DN` should be a parent of any groups and users you want to match with, since this is the base of any searches across the LDAP system. To specific filter/narrow user searches you could instead update the `LDAP_USER_FILTER` value so it only returns the users you want to allow access.

OVERLORD commented

2026-02-05 06:16:35 +03:00

@mschoon85 commented on GitHub (Oct 20, 2022):

Hi Dan,

Thanks for your fast reply. With "it will only work" I mean that it will not validate the login credentials. The only error I see is that the credentials are not valid.

So what you say is that the LDAP_BASE_DN should be: "OU=Admins,OU=Users,DC=companyname,DC=com" and I should use the LDAP_USER_FILTER to search in G_Admin_Group. Do you have an example for me? I already tried many different ways I could think of. For example:

LDAP_USER_FILTER=(&(objectClass=groupOfNames)(cn=G_Admin_Group,OU=Admins,OU=Users,DC=companyname,DC=com))

LDAP_USER_FILTER=(&(memberOf=cn=G_Admin_Group,OU=Admins,OU=Users,DC=companyname,DC=com))

LDAP_USER_FILTER="(&(sAMAccountName=${user})(memberOf=\"cn=G_Admin_Group,OU=Admins,OU=Users,DC=companyname,DC=com\"))"

LDAP_USER_FILTER="(&(sAMAccountname=${user})(memberOf=cn=G_Admin_Group,OU=Admins,OU=Users,DC=companyname,DC=com))"

LDAP_USER_FILTER=(&(sAMAccountName=${user})(memberOf=cn=G_Admin_Group,OU=Admins,OU=Users,DC=companyname,DC=com))

LDAP_USER_FILTER=(&(objectCategory=Person)(sAMAccountName=*)(memberOf=cn=G_Admin_Group,OU=Admins,OU=Users,DC=companyname,DC=com))

LDAP_USER_FILTER=((&(objectClass=Person)(memberOf=cn=G_Admin_Group,OU=Admins,OU=Users,DC=companyname,DC=com))

@mschoon85 commented on GitHub (Oct 20, 2022): Hi Dan, Thanks for your fast reply. With "it will only work" I mean that it will not validate the login credentials. The only error I see is that the credentials are not valid. So what you say is that the LDAP_BASE_DN should be: "OU=Admins,OU=Users,DC=companyname,DC=com" and I should use the LDAP_USER_FILTER to search in G_Admin_Group. Do you have an example for me? I already tried many different ways I could think of. For example: ``` LDAP_USER_FILTER=(&(objectClass=groupOfNames)(cn=G_Admin_Group,OU=Admins,OU=Users,DC=companyname,DC=com)) LDAP_USER_FILTER=(&(memberOf=cn=G_Admin_Group,OU=Admins,OU=Users,DC=companyname,DC=com)) LDAP_USER_FILTER="(&(sAMAccountName=${user})(memberOf=\"cn=G_Admin_Group,OU=Admins,OU=Users,DC=companyname,DC=com\"))" LDAP_USER_FILTER="(&(sAMAccountname=${user})(memberOf=cn=G_Admin_Group,OU=Admins,OU=Users,DC=companyname,DC=com))" LDAP_USER_FILTER=(&(sAMAccountName=${user})(memberOf=cn=G_Admin_Group,OU=Admins,OU=Users,DC=companyname,DC=com)) LDAP_USER_FILTER=(&(objectCategory=Person)(sAMAccountName=*)(memberOf=cn=G_Admin_Group,OU=Admins,OU=Users,DC=companyname,DC=com)) LDAP_USER_FILTER=((&(objectClass=Person)(memberOf=cn=G_Admin_Group,OU=Admins,OU=Users,DC=companyname,DC=com)) ```

OVERLORD commented

2026-02-05 06:16:42 +03:00

@ssddanbrown commented on GitHub (Oct 20, 2022):

These things really depend on the structure and linking of items within your LDAP group, in addition to your intended result, so it's hard for me to say for sure.

Out of what's listed, this looked most reasonable:

LDAP_USER_FILTER=(&(sAMAccountName=${user})(memberOf=cn=G_Admin_Group,OU=Admins,OU=Users,DC=companyname,DC=com))
LDAP_BASE_DN="OU=Admins,OU=Users,DC=companyname,DC=com"

Double check that on the login form your are entering a value that would match the sAMAccountName attribute, not any other.

Have you got a way of running an ldap search against your directory via other means? May be useful to test via that method is possible. You should be able to run the LDAP_USER_FILTER value as a search, replacing ${user} with your user's sAMAccountName value,

@ssddanbrown commented on GitHub (Oct 20, 2022): These things really depend on the structure and linking of items within your LDAP group, in addition to your intended result, so it's hard for me to say for sure. Out of what's listed, this looked most reasonable: ```shell LDAP_USER_FILTER=(&(sAMAccountName=${user})(memberOf=cn=G_Admin_Group,OU=Admins,OU=Users,DC=companyname,DC=com)) LDAP_BASE_DN="OU=Admins,OU=Users,DC=companyname,DC=com" ``` Double check that on the login form your are entering a value that would match the `sAMAccountName` attribute, not any other. Have you got a way of running an ldap search against your directory via other means? May be useful to test via that method is possible. You should be able to run the `LDAP_USER_FILTER` value as a search, replacing `${user}` with your user's `sAMAccountName` value,

OVERLORD commented

2026-02-05 06:16:47 +03:00

@mschoon85 commented on GitHub (Oct 20, 2022):

Hi Dan,

Thank you so much! This works perfectly. One last question which you most likely will be able to answer and will not result in me using google for a long time. How can I use the LDAP_USER_FILTER to search users in multiple groups?

@mschoon85 commented on GitHub (Oct 20, 2022): Hi Dan, Thank you so much! This works perfectly. One last question which you most likely will be able to answer and will not result in me using google for a long time. How can I use the LDAP_USER_FILTER to search users in multiple groups?

OVERLORD commented

2026-02-05 06:16:49 +03:00

@ssddanbrown commented on GitHub (Oct 20, 2022):

How can I use the LDAP_USER_FILTER to search users in multiple groups?

@mschoon85 You could update the boolean logic of the filter to match against multiple groups:

(&(sAMAccountName=${user})(|(memberOf=cn=G_Admin_Group,OU=Admins,OU=Users,DC=companyname,DC=com)(memberOf=cn=Group_Two,OU=Admins,OU=Users,DC=companyname,DC=com)))

The & will combine conditions via AND. The | combines via OR. So stating:

user must match username
AND
(Member of G_Admin_Group OR Member of Group_Two)

Be aware I'm not an expert in LDAP, to test invalid/valid conditions yourself. Also could be a limit on filter length but I'm not totally aware of it.
Could always create an additional group in the LDAP system to match against.

@ssddanbrown commented on GitHub (Oct 20, 2022): > How can I use the LDAP_USER_FILTER to search users in multiple groups? @mschoon85 You could update the boolean logic of the filter to match against multiple groups: ``` (&(sAMAccountName=${user})(|(memberOf=cn=G_Admin_Group,OU=Admins,OU=Users,DC=companyname,DC=com)(memberOf=cn=Group_Two,OU=Admins,OU=Users,DC=companyname,DC=com))) ``` The `&` will combine conditions via `AND`. The `|` combines via `OR`. So stating: ``` user must match username AND (Member of G_Admin_Group OR Member of Group_Two) ``` Be aware I'm not an expert in LDAP, to test invalid/valid conditions yourself. Also could be a limit on filter length but I'm not totally aware of it. Could always create an additional group in the LDAP system to match against.

OVERLORD commented

2026-02-05 06:16:53 +03:00

@mschoon85 commented on GitHub (Oct 20, 2022):

Thanks, Dan! Much appreciated, I got it fully working now. You're the best!

@mschoon85 commented on GitHub (Oct 20, 2022): Thanks, Dan! Much appreciated, I got it fully working now. You're the best!

OVERLORD commented

2026-02-05 06:16:56 +03:00

@ssddanbrown commented on GitHub (Oct 21, 2022):

Good to hear things are working, Will therefore close this off. Hope BookStack works out for your use case!

@ssddanbrown commented on GitHub (Oct 21, 2022): Good to hear things are working, Will therefore close this off. Hope BookStack works out for your use case!

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/BookStack#3292