"Map" LDAP Search filter to an Authentik Group (Solved)

[pseudo comet]

Hello,
I want to use Authentiks LDAP provider for Vaultwarden LDAP (but this applies to any other application). But the tricky thing is, that only a specific Authentik Group should be accessed. The group is called "Vaultwarden" and for structuring purposes it has the parent group "LDAP". So I created a LDAP provider with the search group "LDAP" and the base DN "DC=ldap,DC=domain,DC=tld".
So my question is now, how do I set the search filter in Vaultwarden LDAPs settings to get all corresponding users?
I tried many things in the memberOf parameter and nothing works. What am I doing wrong?

ldap_bind_dn = "cn=akadmin,ou=users,dc=ldap,dc=domain,dc=tld"
ldap_bind_password = "akadmins password"
ldap_search_base_dn = "dc=ldap,dc=domain,dc=tld"
ldap_search_filter = "(&(objectClass=user)(mail=*@*)(memberOf=ou=Vaultwarden,ou=groups,dc=ldap,dc=domain,dc=tld))"

[supple jasper]

Hi @pseudo comet , I think this doesn't look too bad, but in this case, "Vaultwarden" is a CN, not an OU... So it should look like this: memberOf=cn=Vaultwarden,ou=groups,dc=ldap,dc=domain,dc=tld

[pseudo comet]

Thank you for the help, but I tried it and it sadly does not work. I double checked, that the user is in the Vaultwarden group and I added the akadmin user to this group, in case this is an permission problem, but this seems to also not work.

[pseudo comet]

Okay, now I don't understand...
I tried to get all users with ldapsearch -x -h authentik-ldap -p 3389 -D 'cn=akadmin,ou=users,dc=ldap,dc=domain,dc=tld' -w 'password for akadmin' -b 'dc=ldap,dc=domain,dc=tld' '(objectClass=user)' but I only get the akadmin, not any other user I created. What is wrong here?

[molten barn]

Have you set a search group in the LDAP provider? If so, is the user you are making queries with part of that group?

[pseudo comet]

Problem solved, it was the cache. Now my new users can be found

[pseudo comet]

"Map" LDAP Search filter to an Authentik Group (Solved)

[frigid atlas]

@pseudo comet where you signing into bitwarden webui and all with authentik?

[pseudo comet]

No, I use Vaultwarden and Vaultwarden LDAP which invites users to vaultwarden. No SSO!

[frigid atlas]

Ah ok. So it is just an invite🥲