Card #3644 · Grafana
LDAP group search fails with non-standard member attributes
Merchants are struggling to configure LDAP group synchronization when their directory server uses full Distinguished Names (DN) or non-standard attributes for group membership. The current configuration options do not support necessary wildcards or custom user attributes for group filtering, leading to authentication without authorization.
Pain score
0.18/ 1.00 · weighted product of four components
Reach0.73distinct authors (log-normalized)
Recency1.00freshness decay, half-life months
Engagement0.27upvotes + comments, normalized
Monetization0.50willingness-to-pay cues in evidence
§ Evidence — 4 verified quotes
the groupOfNames object has member attribute, but it consists of the whole search DN : uid=user@company.com ,ou=groups,dc=company,dc=com, for example. So i need a wildcard or something to accept the uid= before the username, and the rest of DN after the username, * %s* doesn’t work.
I get authenticated, but am still unauthorized, it acts as if I belong to no organizations.
This looks like a bug, we should add group_search_filter_user_attribute as a valid attribute as well if it is different from the above attributes.
the attribute of Apacheds in groups is “member” and not “memberUid” , which consists of the whole DN (uid=…,ou=…)
Comments are a Pro feature — join the conversation, share what you've shipped, hear what others are building.
Upgrade to Pro