[BUG] LDAP cn not parsed correctly

[Politiezone-MIDOW]

Describe the bug
When i try to allow certain groups i get the error that the user is not found in the group.
When looking in the logs, i get the error pasted below.

Expected behavior
The required should be CN=Whisper_Users,CN=Users,DC=midow,DC=local.
The same as i configured in the .env file.

I have tried the following:

• LDAP_USER_GROUPS=CN=Whisper_Users
• LDAP_USER_GROUPS=CN=Whisper_Users,CN=Users,DC=midow,DC=local
• LDAP_USER_GROUPS="CN=Whisper_Users,CN=Users,DC=midow,DC=local"
• LDAP_USER_GROUPS='CN=Whisper_Users,CN=Users,DC=midow,DC=local'
• LDAP_USER_GROUPS=CN=Whisper_Users,CN=Users,DC=midow,DC=local

This DN is correct for sure, it is being retreived from the active directory as seen in the logs below.

Logs
WARNING:app.auth.ldap_auth:User test449416861 denied access - not a member of any required groups. User groups: ['CN=Whisper_Users,CN=Users,DC=midow,DC=local'], Required: ['CN=Whisper_Users', 'CN=Users', 'DC=midow', 'DC=local']

Additional context
Add any other context about the problem here.

[davidamacey]

Hey @Politiezone-MIDOW, really appreciate you sharing those detailed logs and systematically trying all those formats — made it straightforward to find the root cause.

The bug is in how the group list was parsed: LDAP/AD distinguished names use commas internally (CN=Whisper_Users,CN=Users,DC=midow,DC=local), but we were also splitting the config value on commas — so your single DN was being torn into four fragments that could never match. None of the formats you tried could work because the delimiter conflict was in the code itself, not in how you were writing the value.

The fix changes the multi-group separator to semicolons, since commas are reserved by DN syntax. Going forward, use:

# Single group
LDAP_USER_GROUPS=CN=Whisper_Users,CN=Users,DC=midow,DC=local

# Multiple groups
LDAP_USER_GROUPS=CN=Whisper_Users,CN=Users,DC=midow,DC=local;CN=OtherGroup,DC=midow,DC=local

The same fix applies to LDAP_ADMIN_GROUPS. We are working on it and a fix will be published soon!

[Politiezone-MIDOW]

Thank you for the quick response and fix 🤩

[davidamacey]

Thank you for your patience. I am ensuring all auth tests work end to end. I will push the updated code and docker containers this evening once all tests pass properly.