[FEATURE] Allow based on LDAP groups

Is your feature request related to a problem? Please describe.
It seems it is only possible to define group based access when using Oauth?

Describe the solution you'd like
It would be great if we could do the same using LDAP groups

Describe alternatives you've considered
Forgive me if I am wrong, but I could not find information on this in the docs

Additional context
N/A

This is esentially what I wanted to do in #472

I did a few quick tests using ldapsearch

ldapsearch -x -H ldap://localhost:3890 -D "uid=tinyauth,ou=people,dc=auth,dc=example,dc=com" -w SuperDuperSecurePassword -b "ou=groups,dc=auth,dc=example,dc=com" '(&(objectClass=groupOfNames)(member=MyUser))' uid

# extended LDIF
#
# LDAPv3
# base <ou=groups,dc=auth,dc=example,dc=com> with scope subtree
# filter: (&(objectClass=groupOfNames)(member=MyUser))
# requesting: uid
#

# MyTestGroup, groups, auth.example.com
dn: cn=MyTestGroup,ou=groups,dc=auth,dc=example,dc=com
uid: MyTestGroup

# search result
search: 2
result: 0 Success
control: 1.2.840.113556.1.4.319 false MAUCAQEEAA==
pagedresults: estimate=1 cookie=

# numResponses: 2
# numEntries: 1

So it should be really easy to also query the groups of a user and store them in the same way OAuthGroups are stored already.

Unfortunately I'm not really good at writing or understanding Go, so submiting a PR is far beyound my capabilities 😞

Edit: my test user is named MyUser which is memeber of the group MyTestGroup

I you want to use group I found a solution look here

      - LDAP_ADDRESS=ldap://DC1.demo.test:389
      - LDAP_BIND_DN=CN=USER,OU=TEST,OU=DEMO,DC=TEST,
      - LDAP_BIND_PASSWORD=$YourV€rryStrongP@ssw0rd!!
      - LDAP_BASE_DN=DC=DEMO,DC=TEST
      # Search Group member
      - LDAP_SEARCH_FILTER=(&(sAMAccountName=%s)(memberOf=CN=GROUP1,OU=Groupes,DC=DEMO,DC=TEST))
      - LDAP_INSECURE=true

All user member of this AD group might be authenticated.

This is not what I wanted to achive.
I want to allow a user to use an app based on the groups he is part of.
That way I can have one tinyauth instance that protects multiple apps and I can control which user can use which app based on the groups.

Added with #590!

Can you give a bit of a hint how to get the actual groups?

This is my env file:

LDAP_ADDRESS=ldap://lldap:3890
LDAP_BIND_DN=uid=tinyauth,ou=people,dc=auth,dc=site,dc=com
LDAP_BIND_PASSWORD=<redacted>
LDAP_BASE_DN=dc=auth,dc=site,dc=com
LDAP_SEARCH_FILTER=(uid=%s)
LDAP_INSECURE=true

And this my caddy config

http://service.site.com {
        forward_auth tinyauth:3000 {
                uri /verify
                copy_headers Remote-User Remote-Groups Remote-Name Remote-Email
        }

In my application I see the headers HTTP_REMOTE_EMAIL, HTTP_REMOTE_NAME and HTTP_REMOTE_USER but no HTTP_REMOTE_GROUPS

Do I need to change something in my config?

I verifyed that my user I log in with is member of 2 groups

This feature is not yet released. Alongside with v5 there will be relevant documentation on how to set it up.

Navigation Menu

Repository navigation

[FEATURE] Allow based on LDAP groups #517

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[FEATURE] Allow based on LDAP groups #517

Description

Activity

Bouni commented on Dec 19, 2025

JM2K69 commented on Jan 7, 2026

Bouni commented on Jan 9, 2026

steveiliop56 commented on Jan 17, 2026

Bouni commented on Jan 27, 2026

steveiliop56 commented on Jan 27, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions