User removed from Active Directory group not synced

[maxkes]

Describe the Bug

LDAP authentification with AD option and group sync is enabled and working.

User A is in AD-Group G. On Boockstack Group G is created. When the user logs on Bookstack the first time, an account is created and he is added to the Bookstack Group G. Everything is good so far.
Now I remove user A from AD-Group G. But he is still in Boockstack group G. Even if I remove him manually from Boockstack group G, he is still in group G.

Steps to Reproduce

Have an AD-group and same named Bookstack group.
Add an user to the AD-group.
Remove the user from the AD-group, but he is stil in the Boockstack group.

Expected Behaviour

User is removed from the Boockstack group as well.

Screenshots or Additional Context

No response

Browser Details

No response

Exact BookStack Version

v22.09.1

PHP Version

No response

Hosting Environment

Ubuntu 22.04 Script executed on a fresh Ubuntu 22.04.1 desktop on a VM.

[ssddanbrown]

Hi @maxkes,
Group sync between BookStack and an LDAP system only runs upon user login.
Are you checking group sync/removal after the user has logged in again?
Also, do you have the LDAP_REMOVE_FROM_GROUPS setting defined and set to true?

[maxkes]

DAP_REMOVE_FROM_GROUP was set to false. Setting it to true solved my problem.

Thanks a lot for the quick reply!
I read the documentation for this setting again and these two lines are for a Boockstack-newbie and not-native English speaker hard to understand:

Note: While this is enabled the "Default Registration Role", editable within the
BookStack settings view, will be considered a matched role and assigned to the user.

[ssddanbrown]

Setting it to true solved my problem.

Great! will therefore close this issue off.

I read the documentation for this setting again and these two lines are for a Boockstack-newbie and not-native English speaker hard to understand: ...

It means the setting circled in red below will be used, and the configured role will be assigned to the user upon login, even if it does not match a group in the LDAP system.

(This allows you to ensure users are always assigned a role by default, if needed.)