Issues with LDAP query

[TheD0nald]

Hello awesome people! I have a question and was wondering what I may be doing wrong here. I am setting up ldap on our SNIPEIT instance and setting the filter so that anyone in the "IT" Security group is able to login. My issue is that users in the IT group are able to authenticate, as well as users outside the IT group.

Here is my base bind DN and LDAP filter
ou=Accounts-Users,dc=domain,dc=com
&(objectCategory=Person)(memberOf=CN=IT,OU=Security Groups,ou=Accounts-Users,dc=domain,dc=com)

I changed the domains for privacy reasons. Please help with what im doing wrong exactly?

[uberbrady]

Weird, that filter looks like it should work? When you do a sync do you only see the users that you're expecting to see?

[snipe]

This seems like it would be an issue, not a discussion?

[Solverz-0]

I think this is due to the LDAP filter only filtering the LDAP syncing for users and not the actual LDAP Login. I bet if you done a manual LDAP sync it would give the results you want, however this only applies to sync and not to the actual login. Users who are not in the mention group will still be able to login directly but wont have any of the benefits of LDAP sync applied to them.

I have ran into this issue myself and I am hoping @snipe will be able to explain how to do this :)