LDAP Group sync dont works #4777

New Issue

OVERLORD · 2026-02-05T09:14:58+03:00

OVERLORD commented

2026-02-05 09:14:58 +03:00

Originally created by @GamerClassN7 on GitHub (May 17, 2024).

Describe the Bug

LDAP gropups ate not used by bookstack

Steps to Reproduce

Configure ldap
Setup Group sync
Login

Expected Behaviour

Usel loged in from ad became meber of respective group

Screenshots or Additional Context

No response

Browser Details

No response

Exact BookStack Version

BookStack v24.05

Originally created by @GamerClassN7 on GitHub (May 17, 2024). ### Describe the Bug LDAP gropups ate not used by bookstack ### Steps to Reproduce 1. Configure ldap 2. Setup Group sync 3. Login ### Expected Behaviour Usel loged in from ad became meber of respective group ### Screenshots or Additional Context _No response_ ### Browser Details _No response_ ### Exact BookStack Version BookStack v24.05

OVERLORD added the 🐛 Bug label 2026-02-05 09:14:58 +03:00

OVERLORD closed this issue

2026-02-05 09:14:58 +03:00

OVERLORD commented

2026-02-05 09:15:01 +03:00

@GamerClassN7 commented on GitHub (May 17, 2024):

@GamerClassN7 commented on GitHub (May 17, 2024): ![image](https://github.com/BookStackApp/BookStack/assets/22167469/22516259-8dd5-45a2-ac0c-96916e1973c4)

OVERLORD commented

2026-02-05 09:15:03 +03:00

@GamerClassN7 commented on GitHub (May 17, 2024):

resul tof dumping groups for a user

@GamerClassN7 commented on GitHub (May 17, 2024): ![image](https://github.com/BookStackApp/BookStack/assets/22167469/bedafaf3-fa44-420a-ab32-299ec78c51cd) resul tof dumping groups for a user

OVERLORD commented

2026-02-05 09:15:04 +03:00

@GamerClassN7 commented on GitHub (May 17, 2024):

@GamerClassN7 commented on GitHub (May 17, 2024): ![image](https://github.com/BookStackApp/BookStack/assets/22167469/9c3894dc-bf39-4b69-81f9-9226e5ec8169)

OVERLORD commented

2026-02-05 09:15:06 +03:00

@ssddanbrown commented on GitHub (May 17, 2024):

@GamerClassN7 In the dump the value is wiki_admin, but the role external auth ID is set as wiki_admins, and therefore those don't match up, unless I'm misunderstanding your setup?

@ssddanbrown commented on GitHub (May 17, 2024): @GamerClassN7 In the dump the value is `wiki_admin`, but the role external auth ID is set as `wiki_admins`, and therefore those don't match up, unless I'm misunderstanding your setup?

OVERLORD commented

2026-02-05 09:15:07 +03:00

@GamerClassN7 commented on GitHub (May 17, 2024):

@GamerClassN7 In the dump the value is wiki_admin, but the role external auth ID is set as wiki_admins, and therefore those don't match up, unless I'm misunderstanding your setup?

I am desperate so, i am trying all variations, I even created all variants singular/plural I even typed to use DN and even create new group with same name and external id. :( all attempts without any results :( I posted only last variant of my attempts :(

@GamerClassN7 commented on GitHub (May 17, 2024): > @GamerClassN7 In the dump the value is `wiki_admin`, but the role external auth ID is set as `wiki_admins`, and therefore those don't match up, unless I'm misunderstanding your setup? I am desperate so, i am trying all variations, I even created all variants singular/plural I even typed to use DN and even create new group with same name and external id. :( all attempts without any results :( I posted only last variant of my attempts :(

OVERLORD commented

2026-02-05 09:15:08 +03:00

@ssddanbrown commented on GitHub (May 17, 2024):

Okay, as long as you have something in parsed_recursive_user_groups that exactly matches with the role external auth ID (and the role has been saved with that matching ID), you should be good, there's little that can prevent a sync after that. Most problems arise in handling of different casing & spaces, but if you have wiki_admin aligned on both sides you should be good as that name should not be touched in formatting standardisation.

Did they sync before or is this something new you're setting up?
Do you have any other kinds of authentication active in BookStack?

@ssddanbrown commented on GitHub (May 17, 2024): Okay, as long as you have something in `parsed_recursive_user_groups` that exactly matches with the role external auth ID (and the role has been saved with that matching ID), you should be good, there's little that can prevent a sync after that. Most problems arise in handling of different casing & spaces, but if you have `wiki_admin` aligned on both sides you should be good as that name should not be touched in formatting standardisation. - Did they sync before or is this something new you're setting up? - Do you have any other kinds of authentication active in BookStack?

OVERLORD commented

2026-02-05 09:15:09 +03:00

@GamerClassN7 commented on GitHub (May 20, 2024):

Okay, as long as you have something in parsed_recursive_user_groups that exactly matches with the role external auth ID (and the role has been saved with that matching ID), you should be good, there's little that can prevent a sync after that. Most problems arise in handling of different casing & spaces, but if you have wiki_admin aligned on both sides you should be good as that name should not be touched in formatting standardisation.

Did they sync before or is this something new you're setting up?

Do you have any other kinds of authentication active in BookStack?

Something new i did not used LDAP groups before
No only LDAP

@GamerClassN7 commented on GitHub (May 20, 2024): > Okay, as long as you have something in `parsed_recursive_user_groups` that exactly matches with the role external auth ID (and the role has been saved with that matching ID), you should be good, there's little that can prevent a sync after that. Most problems arise in handling of different casing & spaces, but if you have `wiki_admin` aligned on both sides you should be good as that name should not be touched in formatting standardisation. > > * Did they sync before or is this something new you're setting up? > * Do you have any other kinds of authentication active in BookStack? 1. Something new i did not used LDAP groups before 2. No only LDAP

OVERLORD commented

2026-02-05 09:15:10 +03:00

@ssddanbrown commented on GitHub (May 20, 2024):

I don't really have much else to suggest outside of dumping data within the code.

If possible, within the app/Access/GroupSyncService.php file, you could find line 66 and add:

throw new \BookStack\Exceptions\JsonDebugException(['roles' => $roles->toArray(), 'groups' => $groupNames, 'matched' => $matchedRoles->toArray()]);

That should hopefully provide, on login attempt, full insight into what's calculated at match/comparison time. I have not tested the above though.

@ssddanbrown commented on GitHub (May 20, 2024): I don't really have much else to suggest outside of dumping data within the code. If possible, within the `app/Access/GroupSyncService.php` file, you could find [line 66](https://github.com/BookStackApp/BookStack/blob/295cd0160525125bbd7756d7ad07392ae7201cb8/app/Access/GroupSyncService.php#L66) and add: ```php throw new \BookStack\Exceptions\JsonDebugException(['roles' => $roles->toArray(), 'groups' => $groupNames, 'matched' => $matchedRoles->toArray()]); ``` That should hopefully provide, on login attempt, full insight into what's calculated at match/comparison time. I have not tested the above though.

OVERLORD commented

2026-02-05 09:15:11 +03:00

@RedLighttt commented on GitHub (May 21, 2024):

Hello @ssddanbrown,
unfortunately we also had a problem with German umlauts. We have a group with a small letter ‘ü’.
Under app/Access/GroupSyncService.php after line 59 I added logger($groupNames[$i]); to write the group name into the log. I noticed that the letter ‘ü’ was converted to ‘\c3\bc’. As soon as I insert the logged group name into the ‘External Authentication IDs’, the synchronisation works.

I don't know if this is an error or a misconfiguration on my part.
I hope this information helps you to solve the problem.

@RedLighttt commented on GitHub (May 21, 2024): Hello @ssddanbrown, unfortunately we also had a problem with German umlauts. We have a group with a small letter ‘ü’. Under `app/Access/GroupSyncService.php` after line 59 I added `logger($groupNames[$i]);` to write the group name into the log. I noticed that the letter ‘ü’ was converted to ‘\c3\bc’. As soon as I insert the logged group name into the ‘External Authentication IDs’, the synchronisation works. I don't know if this is an error or a misconfiguration on my part. I hope this information helps you to solve the problem.

OVERLORD commented

2026-02-05 09:15:13 +03:00

@GamerClassN7 commented on GitHub (Nov 27, 2024):

new version resolved issue for me

@GamerClassN7 commented on GitHub (Nov 27, 2024): new version resolved issue for me

OVERLORD commented

2026-02-05 09:15:13 +03:00

@ssddanbrown commented on GitHub (Nov 27, 2024):

@GamerClassN7 Good to hear! I'll therefore close this off.

@ssddanbrown commented on GitHub (Nov 27, 2024): @GamerClassN7 Good to hear! I'll therefore close this off.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/BookStack#4777