# LDAP active directory admin filter

**URL:** <https://forum.gitea.com/t/ldap-active-directory-admin-filter/3689>\
**Category:** Install/Maintain/Configure\
**Created:** [August 30, 2021, 3:11pm UTC](https://forum.gitea.com/t/ldap-active-directory-admin-filter/3689 "2021-08-30T15:11:40Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![miklyaeva](https://avatars.discourse-cdn.com/v4/letter/m/e0b2c6/32.png) [@miklyaeva](https://forum.gitea.com/u/miklyaeva)\
**Post date:** [August 30, 2021, 3:11pm UTC](https://forum.gitea.com/t/ldap-active-directory-admin-filter/3689/1 "2021-08-30T15:11:40Z")

</div>

Hello, the administrator filter for both the group and the user does not work for us, although the authorization and synchronization of ordinary users is successful.  
User search base: OU=ORG,DC=org,DC=ru  
Administrator filter:(&(sAMAccountName=Novikov)(OU=Users,OU=2882,OU= ORG,DC=org,DC=ru))  
User Filter: (sAMAccountName=%s)

---

<div class="post-metadata">

**Author:** ![Rockyboa](https://avatars.discourse-cdn.com/v4/letter/r/8491ac/32.png) [@Rockyboa](https://forum.gitea.com/u/Rockyboa)\
**Post date:** [September 27, 2022, 9:02pm UTC](https://forum.gitea.com/t/ldap-active-directory-admin-filter/3689/2 "2022-09-27T21:02:10Z")

</div>

Same here, have you been able to find why. Here are my User and Admin LDAP query

(&(objectCategory=Person)(memberOf=CN=Users\_GIT,OU=AEP,DC=ad,DC=aep,DC=com)(sAMAccountName=%s)(!(UserAccountControl:1.2.840.113556.1.4.803:=2)))

(&(objectCategory=Person)(memberOf=CN=Admin\_GIT,OU=AEP,DC=ad,DC=aep,DC=com)(sAMAccountName=%s)(!(UserAccountControl:1.2.840.113556.1.4.803:=2)))

Working for user, not working for admin, even if user is in both group, it will not turn on admin priviliges

Martin

---

<div class="post-metadata">

**Author:** ![daniel2](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.gitea.com/daniel2/32/5080_2.png) [@daniel2](https://forum.gitea.com/u/daniel2)\
**Post date:** [September 28, 2022, 10:00pm UTC](https://forum.gitea.com/t/ldap-active-directory-admin-filter/3689/3 "2022-09-28T22:00:00Z")

</div>

I’m by far no expert, but:

1. Have you tried `Admin_GIT` without underscore like `Admin-GIT`?
2. Does the log show something about the authentication?
3. I think the admin query/filter is just for filtering admins (additionaly to the user filter, not generally if a user can sign in), so in this case you might remove the `objectCategory`, `UserAccountControl`, `sAMAccountName` attribute-filters.

PS: maybe use codeblocks like below, to enhance the readability of the ldap queries etc.

```auto
(memberOf=CN=Admin_GIT,OU=AEP,DC=ad,DC=aep,DC=com)

```

---

<div class="post-metadata">

**Author:** ![Rockyboa](https://avatars.discourse-cdn.com/v4/letter/r/8491ac/32.png) [@Rockyboa](https://forum.gitea.com/u/Rockyboa)\
**Post date:** [September 29, 2022, 12:12pm UTC](https://forum.gitea.com/t/ldap-active-directory-admin-filter/3689/4 "2022-09-29T12:12:56Z")

</div>

Daniel,

Simplifying the query work as expected! Thank you very much. This simplified admin query did the job, still not sure the first query worked to populate my users and the admin didn’t.

Martin

---

<div class="post-metadata">

**Author:** ![daniel2](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.gitea.com/daniel2/32/5080_2.png) [@daniel2](https://forum.gitea.com/u/daniel2)\
**Post date:** [September 29, 2022, 3:33pm UTC](https://forum.gitea.com/t/ldap-active-directory-admin-filter/3689/5 "2022-09-29T15:33:00Z")

</div>

Great to hear success.

Maybe the variable `%s` doesn’t get resolved in the admin filter and so it can’t find anyone named “%s”.