Repository navigation
[Feature]: createLdapUser does not pull group memberships #5798
Description
Bug Summary
when using the API to create a new user from LDAP username it does not include the group memberships, permissions based on group membership not working
Description
I use an app to push tasks to the kanboard. When the username is not known it creates the user from the LDAP via API before pushing the task.
Kanboard is configured with proxy LDAP user. creating the user does work. The user has not the rights given by the group membership.
After setting the user in the kanboard to a specific role it works. Removing the user permission it works not, even if the same role is given to the one group the user has in the AD.
When the user logs into the kanboard directly the groups are loaded and subsequent API requests work as now the permissions are loaded.
Steps to Reproduce
- create a group "shouldhaverights" in AD
- assign the group some permissions/custom role in kanboard (like not allowed to create a task except in specific column)
- Create a user "newLdapKanboardUser" in AD and assign the group "shouldhaverights"
- use API to create a user from LDAP with given username "newLdapKanboardUser" (createLdapUser)
Get the user id for creating a new task with the user as author (getUserByName) - send a createTask request to API with the creatorId of the newLdapKanboardUser
- see response false (missing permissions to create task)
Additional you can test setting newLdapKanboardUser as a user permission to the same custom role/permission that the group membership should give
When sending a createTask API request it works. When removing the user permission it stops working.
When you login to the kanboard with the newLdapKanboardUser (and AD password) the API does work with the group permission
Expected Behavior
When creating the LDAP user it should pull the group memberships and the permissions gased on group membership should work.
Actual Behavior
createLdapUser does create user but user has no group assigned permissions
Version
1.2.46
Database
MySQL
PHP Version
No response
Browser
No response
Operating System
No response
Relevant Logs or Error Output
Additional Context
No response
Checklist
- I have searched existing issues to ensure this bug hasn't been reported before.
- I verified that the problem is not caused by a plugin. Please report the issue to the plugin author if applicable.
Activity
Anspitzen commentedon Apr 1, 2026
My current solution/workaround is to look up the LDAP user after sending API request to create said user in Kanboard from the LDAP user.
Get all groups from the LDAP user, get all available groups from the Kanboard.
Make a list of all (kanboard) group Ids, where the ldap-group DistinguishedName is the same as a kanboard AdGroupPrincipleName.
Then send a addGroupMember-request for each of these groups with the Id of the newly created LDAP user.
It's not super performant, as I have to send a request for each single group but works for the time being.
I haven't checked the group sync after the creation (if I remove a group from LDAP user, does it remove the group/permission in kanboard also?)
fguillot commentedon Apr 1, 2026
This behavior was not part of the original intent when the feature was introduced in PR #524 back in 2015.
If you have a specific enhancement in mind, feel free to open a pull request.
[-][Bug]: createLdapUser does not pull group memberships[/-][+][Feature]: createLdapUser does not pull group memberships[/+]