LDAP Admin Group Not Working As Intended?

[EchoApeiron]

Sadly due to the limited documentation I'm not sure what depth this issue has. I got the LDAP plugin configured correctly. If a user was part of a group in my LdapSearchFilter they able to login with no issues and the account is created.

However, I had a user that was only part of the admin group that was defined in the LdapAdminFilter parameter. This user was unable to login. Only until I added them into my User Group were they able to log in. Then even when they did log in and their account was created it wasn't created as an administrative account.

Below are my current configurations and screen shots to help provide evidence to the issue:

<?xml version="1.0"?>
<PluginConfiguration xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
  <LdapServer>server.domain.xyz</LdapServer>
  <LdapBaseDn>DC=domain,DC=xyz</LdapBaseDn>
  <LdapPort>389</LdapPort>
  <LdapSearchAttributes>SamAccountName</LdapSearchAttributes>
  <LdapUsernameAttribute>SamAccountName</LdapUsernameAttribute>
  <LdapSearchFilter>(memberOf=CN=Jellyfin-Users,OU=O-Groups,DC=domain,DC=xyz)</LdapSearchFilter>
  <LdapAdminFilter>(memberOf=CN=Jellyfin-Admins,OU=O-Groups,DC=domain,DC=xyz)</LdapAdminFilter>
  <LdapBindUser>CN=Jellyfin LDAP,OU=Service-Accounts,OU=O-Users,DC=domain,DC=xyz</LdapBindUser>
  <LdapBindPassword>mysupersecurepassword</LdapBindPassword>
  <CreateUsersFromLdap>true</CreateUsersFromLdap>
  <UseSsl>false</UseSsl>
  <UseStartTls>false</UseStartTls>
  <SkipSslVerify>false</SkipSslVerify>
</PluginConfiguration>

When I was finally able to login with the user I had to manually promote them to admin.

[arantes555]

Seems linked to #55

[NolanWelser]

I'm unsure about the other issue link here, but for your described problem I believe jellyfin expects your users to ALL be "users" and some users to be "users" and "admins". I solved the problem by putting the following in my LDAP User Filer setting (and keeping the same admin filter as you have)

(|(memberOf=CN=JellyfinUser,OU=groups,DC=domain,DC=com)(memberOf=CN=JellyfinAdmin,OU=groups,DC=domain,DC=com))

So if you're marked as a user OR admin you can login, but only actual admins will be given admin rights. Hope this helps!