More LDAP Options #6128

New issue

Open

opened 2026-05-13 10:30:51 +02:00 by DrakeHamString · 0 comments

DrakeHamString commented

2026-05-13 10:30:51 +02:00

Describe the feature you'd like

Right now, every login in our environment needs 10-20 seconds, even causes timeouts. And while a user tries to log in, the whole bookstack instance freezes and is not usable for every user! Once the user successfully logged in, the instance is snappy again.

Currently its caused by the LDAP group sync which tries to fetch every LDAP group (I think)

It would help to specify LDAP Scopes for this:

LDAP Filter to limit the search scope for groups:
This can be achieved by a plain LDAP query or by specifying a specific OU / container which has all needed groups in it.
LDAP Filter for users
This can also be achieved by a plain LDAP query. In our case we would like to limit the users that are able to log in by requiring a specific group membership
Example:
(&(|(memberOf=cn=fancygroup,ou=bookstack,o=main))(|(objectClass=Person)(objectClass=inetOrgPerson)))
"External Authentication IDs": Specify DN instead of CN (both for user and group/role)
This eliminates searching the whole tree for a CN and instead directly addresses the DN. (which is the full LDAP path)
This also elimiates problems witn CN duplicate names.
Example:
cn=fancygroup,ou=bookstack,o=main

Describe the benefits this would bring to existing BookStack users

Users in large AD / LDAP environments would get a massive performance gain with logins and there would no impact if another user tries to log in.

Can the goal of this request already be achieved via other means?

Have you searched for an existing open/closed issue?

I have searched for existing issues and none cover my fundamental request

How long have you been using BookStack?

Under 3 months

Additional context

No response

Have you used generative AI/LLMs to create any thoughts in this request?

This request only contains the thoughts & ideas of a human

### Describe the feature you'd like Right now, every login in our environment needs 10-20 seconds, even causes timeouts. **And while a user tries to log in, the whole bookstack instance freezes and is not usable for every user!** Once the user successfully logged in, the instance is snappy again. Currently its caused by the LDAP group sync which tries to fetch every LDAP group (I think) It would help to specify LDAP Scopes for this: 1. LDAP Filter to limit the search scope for groups: This can be achieved by a plain LDAP query or by specifying a specific OU / container which has all needed groups in it. 2. LDAP Filter for users This can also be achieved by a plain LDAP query. In our case we would like to limit the users that are able to log in by requiring a specific group membership Example: `(&(|(memberOf=cn=fancygroup,ou=bookstack,o=main))(|(objectClass=Person)(objectClass=inetOrgPerson)))` 3. "External Authentication IDs": Specify DN instead of CN (both for user and group/role) This eliminates searching the whole tree for a CN and instead directly addresses the DN. (which is the full LDAP path) This also elimiates problems witn CN duplicate names. Example: `cn=fancygroup,ou=bookstack,o=main` ### Describe the benefits this would bring to existing BookStack users Users in large AD / LDAP environments would get a massive performance gain with logins and there would no impact if another user tries to log in. ### Can the goal of this request already be achieved via other means? No ### Have you searched for an existing open/closed issue? - [x] I have searched for existing issues and none cover my fundamental request ### How long have you been using BookStack? Under 3 months ### Additional context _No response_ ### Have you used generative AI/LLMs to create any thoughts in this request? - [x] This request only contains the thoughts & ideas of a human

DrakeHamString added the

Type

Feature Request

label

2026-05-13 10:30:51 +02:00

DrakeHamString referenced this issue

2026-05-13 10:39:27 +02:00

Whole Bookstack instance unusable and runs into timeout when one user tries to log in while LDAP group sync is active #6129