Previously, if a user configured the LDAP search filter to use placeholders like (uid=%s), these placeholders were never substituted with the actual username. The filter was concatenated as-is, resulting in malformed LDAP queries and "User not found" errors.
Added
N/A
Changed
N/A
Deprecated
N/A
Removed
N/A
Fixed
LDAP search filter now properly substitutes %s and %(user)s placeholders with the escaped username
Users can now create complex LDAP filters like:
(uid=%s) - simple user lookup
(&(objectClass=person)(memberOf=cn=allowed-users,ou=groups,dc=example,dc=com)(uid=%s)) - lookup with group membership restriction
Security
Username is properly escaped using escape_filter_chars() before substitution to prevent LDAP injection attacks
The fix adds placeholder substitution logic before constructing the LDAP search filter
Screenshots or Videos
N/A - Backend fix only
Contributor License Agreement
By submitting this pull request, I confirm that I have read and fully agree to the Contributor License Agreement (CLA), and I am providing my contributions under its terms.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/open-webui/open-webui/pull/20160
**Author:** [@polaz](https://github.com/polaz)
**Created:** 12/24/2025
**Status:** ❌ Closed
**Base:** `dev` ← **Head:** `fix/ldap-search-filter-placeholder-v2`
---
### 📝 Commits (1)
- [`cd8e2c2`](https://github.com/open-webui/open-webui/commit/cd8e2c2d30084eb644762f6c224c92f814054859) fix(ldap): enable placeholder substitution in LDAP search filters
### 📊 Changes
**1 file changed** (+13 additions, -1 deletions)
<details>
<summary>View changed files</summary>
📝 `backend/open_webui/routers/auths.py` (+13 -1)
</details>
### 📄 Description
# Pull Request Checklist
- [x] **Target branch:** Verify that the pull request targets the `dev` branch.
- [x] **Description:** Provided below.
- [x] **Changelog:** Provided below.
- [x] **Documentation:** No documentation changes needed (feature was already documented but not working).
- [x] **Dependencies:** No new dependencies.
- [x] **Testing:** Manually verified the fix logic.
- [x] **Agentic AI Code:** This PR was reviewed and the fix is straightforward - it adds placeholder substitution that was missing.
- [x] **Code review:** Self-reviewed.
- [x] **Title Prefix:** Using `fix:` prefix.
# Changelog Entry
### Description
This PR fixes the LDAP search filter placeholder substitution issue discussed in https://github.com/open-webui/open-webui/discussions/16760
Previously, if a user configured the LDAP search filter to use placeholders like `(uid=%s)`, these placeholders were never substituted with the actual username. The filter was concatenated as-is, resulting in malformed LDAP queries and "User not found" errors.
### Added
- N/A
### Changed
- N/A
### Deprecated
- N/A
### Removed
- N/A
### Fixed
- LDAP search filter now properly substitutes `%s` and `%(user)s` placeholders with the escaped username
- Users can now create complex LDAP filters like:
- `(uid=%s)` - simple user lookup
- `(&(objectClass=person)(memberOf=cn=allowed-users,ou=groups,dc=example,dc=com)(uid=%s))` - lookup with group membership restriction
### Security
- Username is properly escaped using `escape_filter_chars()` before substitution to prevent LDAP injection attacks
### Breaking Changes
- N/A
---
### Additional Information
- Related discussion: https://github.com/open-webui/open-webui/discussions/16760
- The fix adds placeholder substitution logic before constructing the LDAP search filter
### Screenshots or Videos
N/A - Backend fix only
### Contributor License Agreement
By submitting this pull request, I confirm that I have read and fully agree to the [Contributor License Agreement (CLA)](https://github.com/open-webui/open-webui/blob/main/CONTRIBUTOR_LICENSE_AGREEMENT), and I am providing my contributions under its terms.
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/open-webui/open-webui/pull/20160
Author: @polaz
Created: 12/24/2025
Status: ❌ Closed
Base:
dev← Head:fix/ldap-search-filter-placeholder-v2📝 Commits (1)
cd8e2c2fix(ldap): enable placeholder substitution in LDAP search filters📊 Changes
1 file changed (+13 additions, -1 deletions)
View changed files
📝
backend/open_webui/routers/auths.py(+13 -1)📄 Description
Pull Request Checklist
devbranch.fix:prefix.Changelog Entry
Description
This PR fixes the LDAP search filter placeholder substitution issue discussed in https://github.com/open-webui/open-webui/discussions/16760
Previously, if a user configured the LDAP search filter to use placeholders like
(uid=%s), these placeholders were never substituted with the actual username. The filter was concatenated as-is, resulting in malformed LDAP queries and "User not found" errors.Added
Changed
Deprecated
Removed
Fixed
%sand%(user)splaceholders with the escaped username(uid=%s)- simple user lookup(&(objectClass=person)(memberOf=cn=allowed-users,ou=groups,dc=example,dc=com)(uid=%s))- lookup with group membership restrictionSecurity
escape_filter_chars()before substitution to prevent LDAP injection attacksBreaking Changes
Additional Information
Screenshots or Videos
N/A - Backend fix only
Contributor License Agreement
By submitting this pull request, I confirm that I have read and fully agree to the Contributor License Agreement (CLA), and I am providing my contributions under its terms.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.