🐛 Bug Report: LDAP Admin Group Name not working #80

New Issue

OVERLORD · 2025-10-07T00:00:57+03:00

OVERLORD commented

2025-10-07 00:00:57 +03:00

Originally created by @CorentinGrard on GitHub.

Originally assigned to: @kmendell on GitHub.

Reproduction steps

I'm trying in use LLDAP with PocketID. I'm new to LDAP so it's possible I've made a mistake.
Prerequire LLDAP.

In LLDAP

Create an admin group
Create an admin user and add it in the admin group
On pocket id fill the LDAP info as such
Save and sync. After sync you should see the user being added in pocket id but without the admin rights only as a normal user

Expected behavior

When adding a group name in Admin Group Name, it should make the users in the group admin in pocket id

Actual Behavior

When configuring LDAP on PocketID after entering all the values you will find bellow, I managed to sync my LDAP with PocketID, but I cannot make work the Admin Group Name field.
On LLDAP I have a group called admin with a user in it. I have added admin in the field Admin Group Name

Pocket ID LDAP config:

LLDAP User Attributes:

LLDAP Group Attributes:

PocketID User:

LLDAP admin User:

Version and Environment

v1.7

Log Output

No response

Originally created by @CorentinGrard on GitHub. Originally assigned to: @kmendell on GitHub. ### Reproduction steps I'm trying in use LLDAP with PocketID. I'm new to LDAP so it's possible I've made a mistake. Prerequire LLDAP. In LLDAP - Create an admin group - Create an admin user and add it in the admin group - On pocket id fill the LDAP info as such <img width="1302" height="987" alt="Image" src="https://github.com/user-attachments/assets/21aa0f57-0cbc-4c53-85ad-167d52327118" /> - Save and sync. After sync you should see the user being added in pocket id but without the admin rights only as a normal user ### Expected behavior When adding a group name in Admin Group Name, it should make the users in the group admin in pocket id ### Actual Behavior When configuring LDAP on PocketID after entering all the values you will find bellow, I managed to sync my LDAP with PocketID, but I cannot make work the Admin Group Name field. On LLDAP I have a group called `admin` with a user in it. I have added `admin` in the field `Admin Group Name` Pocket ID LDAP config: <img width="1339" height="633" alt="Image" src="https://github.com/user-attachments/assets/6e0b4e60-0702-4906-abb5-f0ff3c50da7e" /> LLDAP User Attributes: <img width="1087" height="631" alt="Image" src="https://github.com/user-attachments/assets/47975159-0ab6-4dbd-b8b6-bfdcd6116346" /> LLDAP Group Attributes: <img width="1076" height="453" alt="Image" src="https://github.com/user-attachments/assets/e3221427-82e6-44e5-8af7-b7fabf9595bf" /> PocketID User: <img width="1270" height="91" alt="Image" src="https://github.com/user-attachments/assets/1580ca1d-5e9d-4d98-98a6-3b0689408d00" /> LLDAP admin User: <img width="990" height="898" alt="Image" src="https://github.com/user-attachments/assets/0d52b3ab-af6d-4b33-bedc-e48f31b1ad81" /> ### Version and Environment v1.7 ### Log Output _No response_

OVERLORD closed this issue

2025-10-07 00:00:59 +03:00

OVERLORD commented

2025-10-07 00:01:01 +03:00

@kmendell commented on GitHub:

Change the Group Name Attribute to cn that should fix it for now. Ill try to look into a fix, but i think its a missconception with lldaps schema to be honest.

@kmendell commented on GitHub: Change the Group Name Attribute to `cn` that should fix it for now. Ill try to look into a fix, but i think its a missconception with lldaps schema to be honest.

OVERLORD commented

2025-10-07 00:01:02 +03:00

@kmendell commented on GitHub:

So its not a bug, moreover a misnaming of variables and the fields.

What LLDAP returns in memberOf on users:
memberOf: cn=admin,ou=groups,dc=pocket-id,dc=org

What the admin group object looks like:

dn: cn=admin,ou=groups,dc=pocket-id,dc=org
cn: admin
display_name: Administrators

What PocketID’s current code does

For each memberOf DN, it extracts the configured “Group Name Attribute” from the DN and compares it to “Admin Group Name”.

So how we get this info is:

getDNProperty("display_name", "admin") // just an example

The distinguishedName ends up being display_name=admin,ou=groups,dc=pocket-id,dc=org

Which is not valid ldap syntax for a DN. The display name in lldap is a attribute not part of the distinguisedName. So this may be a misnamed thing on pocket-ids part as well.

Most likley the easiest fix here is to rename the field. Which i opened a PR for, but well want to rename the actual variable as well.

@kmendell commented on GitHub: So its not a bug, moreover a misnaming of variables and the fields. What LLDAP returns in memberOf on users: memberOf: cn=admin,ou=groups,dc=pocket-id,dc=org What the admin group object looks like: ``` dn: cn=admin,ou=groups,dc=pocket-id,dc=org cn: admin display_name: Administrators ``` What PocketID’s current code does For each memberOf DN, it extracts the configured “Group Name Attribute” from the DN and compares it to “Admin Group Name”. So how we get this info is: ``` getDNProperty("display_name", "admin") // just an example ``` The distinguishedName ends up being `display_name=admin,ou=groups,dc=pocket-id,dc=org` Which is not valid ldap [syntax](https://learn.microsoft.com/en-us/previous-versions/windows/desktop/ldap/distinguished-names) for a DN. The display name in lldap is a attribute not part of the distinguisedName. So this may be a misnamed thing on pocket-ids part as well. Most likley the easiest fix here is to rename the field. Which i opened a PR for, but well want to rename the actual variable as well.

OVERLORD commented

2025-10-07 00:01:02 +03:00

@CorentinGrard commented on GitHub:

Yes that did the trick, thanks @kmendell

@CorentinGrard commented on GitHub: Yes that did the trick, thanks @kmendell

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/pocket-id#80