LDAP group filter (authentication source) it not recursive #7495

New Issue

GiteaMirror · 2025-11-02T07:27:28-06:00

GiteaMirror commented

2025-11-02 07:27:28 -06:00

Originally created by @Saaha on GitHub (Jun 21, 2021).

Gitea version (or commit ref): 1.14.2
Git version: 2.25.1
Operating system: Ubuntu 20.04.2 LTS, installed from deb package, running with systemctl
- PostgreSQL
- MySQL
- MSSQL
- SQLite
Can you reproduce the bug at https://try.gitea.io:
- Yes (provide example URL)
- No
Log gist:
No log.

Description

Hi,

It seems LDAP group filter (verify Group membership) in authentication sources, precisely the field Valid Groups Filter is not recursive. I have a group configured, but it does not valid the user if he is in a sub group below.

I suggest to add an option below to allow recursive search in all valid patterns if checked.

Screenshots

Originally created by @Saaha on GitHub (Jun 21, 2021). - Gitea version (or commit ref): 1.14.2 - Git version: 2.25.1 - Operating system: Ubuntu 20.04.2 LTS, installed from deb package, running with systemctl - [x] PostgreSQL - [ ] MySQL - [ ] MSSQL - [ ] SQLite - Can you reproduce the bug at https://try.gitea.io: - [ ] Yes (provide example URL) - [x] No - Log gist: No log. ## Description Hi, It seems LDAP group filter (_verify Group membership_) in authentication sources, precisely the field _Valid Groups Filter_ is not recursive. I have a group configured, but it does not valid the user if he is in a sub group below. I suggest to add an option below to allow recursive search in all valid patterns if checked. ## Screenshots ![gitea_upgrade](https://user-images.githubusercontent.com/10400904/122781752-6a093f00-d2b0-11eb-9a27-9bf42a628260.png)

GiteaMirror added the type/feature topic/authentication labels 2025-11-02 07:27:28 -06:00

GiteaMirror commented

2025-11-02 07:27:29 -06:00

@markkrj commented on GitHub (Jun 28, 2021):

If you're using Active Directory, you could disable the Verify group membership in LDAP option and setup a user filter, like:
(&(objectclass=user)(memberof:1.2.840.113556.1.4.1941:=cn=group,ou=groups,dc=example,dc=com))
If not using AD, group traversal must be done by the client (Gitea server in this case), as most LDAP providers do not implement LDAP_MATCHING_RULE_IN_CHAIN (I think only MS AD does).

IMHO, this option of verifying groups is useless in current state of Gitea, as there is no group implementation in Gitea, and therefore no LDAP group synchronization.

@markkrj commented on GitHub (Jun 28, 2021): If you're using Active Directory, you could disable the `Verify group membership in LDAP` option and setup a `user filter`, like: `(&(objectclass=user)(memberof:1.2.840.113556.1.4.1941:=cn=group,ou=groups,dc=example,dc=com))` If not using AD, group traversal must be done by the client (Gitea server in this case), as most LDAP providers do not implement `LDAP_MATCHING_RULE_IN_CHAIN` (I think only MS AD does). IMHO, this option of verifying groups is useless in current state of Gitea, as there is no group implementation in Gitea, and therefore no LDAP group synchronization.

GiteaMirror commented

2025-11-02 07:27:29 -06:00

@bdleedy commented on GitHub (Nov 22, 2022):

Thanks for this explanation. The documentation does not differentiate why you might use user filter vs ldap group membership. Sticking with the working user filter.

@bdleedy commented on GitHub (Nov 22, 2022): Thanks for this explanation. The documentation does not differentiate why you might use user filter vs ldap group membership. Sticking with the working user filter.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#7495