<p>I am using Dex as our Identity provider and connecting it to LDAP. Below is my ldap config in Dex:</p>

<pre><code>connectors:
- type: ldap
 id: ldap
 name: LDAP
 config:
   host: myhost.staging.com:636
   insecureNoSSL: false
   insecureSkipVerify: false
   bindDN: cn=prometheus-proxy,ou=serviceaccounts,dc=staging,dc=comp,dc=com
   bindPW: 'prometheus'
   rootCA: /etc/dex/ldap/ca-bundle.pem
   userSearch:
     baseDN: ou=people,dc=staging,dc=comp,dc=com
     filter: "(objectClass=person)"
     username: uid
     idAttr: uid
     emailAttr: mail
     nameAttr: uid
   groupSearch:
     baseDN: ou=appgroups,dc=staging,dc=comp,dc=com
     filter: "(objectClass=groupOfMembers)"
     userAttr: DN
     groupAttr: member
     nameAttr: cn
</code></pre>

<p>And below is a sample userSearch &amp; groupSearch Result:</p>

<pre><code>dn: uid=swedas01,ou=people,dc=staging,dc=comp,dc=com
objectClass: inetOrgPerson
objectClass: posixAccount
cn: Sweta Das
gecos: Sweta Das
gidNumber: 50000
givenName: Sweta
mail: Sweta.Das@comp.com
sn: Das
uid: swedas01
memberOf: cn=jenkins,ou=appgroups,dc=staging,dc=comp,dc=com
homeDirectory: /home/swedas01

dn: cn=prometheus,ou=appgroups,dc=staging,dc=comp,dc=com
objectClass: top
objectClass: groupOfMembers
cn: prometheus
member: uid=testl01,ou=people,dc=staging,dc=comp,dc=com
</code></pre>

<p>When I login to my Prometheus instance which uses the above config, even though my userID is not part of the Group that is being used ie Prometheus, I am still able to login.</p>

<p>Dex logs shows there is no groups associated with my id. </p>

<pre><code>time="2019-10-07T19:05:48Z" level=info msg="performing ldap search ou=people,dc=staging,dc=comp,dc=com sub (&amp;(objectClass=person)(uid=swedas01))"
time="2019-10-07T19:05:48Z" level=info msg="username \"swedas01\" mapped to entry uid=swedas01,ou=people,dc=staging,dc=comp,dc=com"
time="2019-10-07T19:05:48Z" level=info msg="performing ldap search cn=prometheus,ou=appgroups,dc=staging,dc=comp,dc=com sub (&amp;(objectClass=groupOfMembers)(member=uid=swedas01,ou=people,dc=staging,dc=comp,dc=com))"
time="2019-10-07T19:05:48Z" level=error msg="ldap: groups search with filter \"(&amp;(objectClass=groupOfMembers)(member=uid=swedas01,ou=people,dc=staging,dc=comp,dc=com))\" returned no groups"
time="2019-10-07T19:05:48Z" level=info msg="login successful: connector \"ldap\", username=\"swedas01\", email=\"Sweta.Das@comp.com\", groups=[]"
</code></pre>

<p>But why is it still allowing me to login? Is there any way I can mandate this setting if group serach returns empty, login should fail?</p>

<p>Since your directory supports <code>memberOf</code> attribute, you can try adding a membership condition in the userSearch filter.</p>
<p>Now look :</p>
<pre><code>username: uid
filter: &quot;(objectClass=person)&quot;
</code></pre>
<p>yields the following ldap filter :</p>
<pre><code>&quot;(&amp;(objectClass=person)(uid=&lt;uid&gt;))&quot;
</code></pre>
<p>So it might be possible to add the membership condition <em>without</em> operator in the filter setting, as dex is actually adding the operator itself (tested and confirmed by @MohammadYusefpur).</p>
<p>Like :</p>
<pre><code>filter: &quot;(objectClass=person)(memberOf=cn=prometheus,ou=appgroups,dc=staging,dc=comp,dc=com)&quot;
</code></pre>
<p>so that the actual ldap filter results in</p>
<pre><code>(&amp;(objectClass=person)(memberOf=cn=prometheus,ou=appgroups,dc=staging,dc=comp,dc=com)(uid=&lt;uid&gt;))
</code></pre>
