From 5675913deec57f3720757a6429366a12bc94527a Mon Sep 17 00:00:00 2001
From: Wilton Rodrigues <wiltonsr94@gmail.com>
Date: Tue, 28 Apr 2026 16:09:09 -0300
Subject: [PATCH] Add option to customize group search

- Fixes #72
---
 ldapauth.go | 12 +++++++++++-
 readme.md   | 12 ++++++++++++
 2 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/ldapauth.go b/ldapauth.go
index b52da85..2a96552 100644
--- a/ldapauth.go
+++ b/ldapauth.go
@@ -75,6 +75,8 @@ type Config struct {
 	ForwardExtraLdapHeaders    bool               `json:"forwardExtraLdapHeaders,omitempty" yaml:"forwardExtraLdapHeaders,omitempty"`
 	WWWAuthenticateHeader      bool               `json:"wwwAuthenticateHeader,omitempty" yaml:"wwwAuthenticateHeader,omitempty"`
 	WWWAuthenticateHeaderRealm string             `json:"wwwAuthenticateHeaderRealm,omitempty" yaml:"wwwAuthenticateHeaderRealm,omitempty"`
+	EnableCustomGroupFilter    bool               `json:"enableCustomGroupFilter,omitempty" yaml:"enableCustomGroupFilter,omitempty"`
+	CustomGroupFilter          string             `json:"customGroupFilter,omitempty" yaml:"customGroupFilter,omitempty"`
 	EnableNestedGroupFilter    bool               `json:"enableNestedGroupsFilter,omitempty" yaml:"enableNestedGroupsFilter,omitempty"`
 	AllowedGroups              []string           `json:"allowedGroups,omitempty" yaml:"allowedGroups,omitempty"`
 	AllowedUsers               []string           `json:"allowedUsers,omitempty" yaml:"allowedUsers,omitempty"`
@@ -113,6 +115,8 @@ func CreateConfig() *Config {
 		ForwardExtraLdapHeaders:    false,
 		WWWAuthenticateHeader:      true,
 		WWWAuthenticateHeaderRealm: "",
+		EnableCustomGroupFilter:    false,
+		CustomGroupFilter:          "",
 		EnableNestedGroupFilter:    false,
 		AllowedGroups:              nil,
 		AllowedUsers:               nil,
@@ -424,6 +428,10 @@ func LdapCheckUserGroups(conn *ldap.Conn, config *Config, entry *ldap.Entry, use
 		"(member={{.UserDN}})" +
 		"(uniqueMember={{.UserDN}})" +
 		"(memberUid={{.Username}})" +
+		"{{if .EnableCustomGroupFilter}}" +
+		"({{.CustomGroupFilter}}={{.UserDN}})" +
+		"({{.CustomGroupFilter}}={{.Username}})" +
+		"{{end}}" +
 		"{{if .EnableNestedGroupFilter}}" +
 		"(member:1.2.840.113556.1.4.1941:={{.UserDN}})" +
 		"{{end}}" +
@@ -435,7 +443,9 @@ func LdapCheckUserGroups(conn *ldap.Conn, config *Config, entry *ldap.Entry, use
 			UserDN                  string
 			Username                string
 			EnableNestedGroupFilter bool
-		}{ldap.EscapeFilter(entry.DN), ldap.EscapeFilter(username), config.EnableNestedGroupFilter})
+			EnableCustomGroupFilter bool
+			CustomGroupFilter       string
+		}{ldap.EscapeFilter(entry.DN), ldap.EscapeFilter(username), config.EnableNestedGroupFilter, config.EnableCustomGroupFilter, config.CustomGroupFilter})
 
 	LoggerDEBUG.Printf("Group Filter: '%s'", group_filter.String())
 
diff --git a/readme.md b/readme.md
index d543e92..026b003 100644
--- a/readme.md
+++ b/readme.md
@@ -336,6 +336,18 @@ _Optional, Default: `""`_
 
 The name of the realm to specify in the `WWW-Authenticate` header. This option is ineffective unless the `wwwAuthenticateHeader` option is set to true.
 
+##### `enableCustomGroupFilter`
+
+_Optional, Default: `false`_
+
+If you need custom filters in addition to `(|(member=?)(uniqueMember=?)(memberUid=?))`, enable this option and set `customGroupFilter` option.
+
+##### `customGroupFilter`
+
+_Optional, Default: `""`_
+
+Custom filters in addition to `(|(member=?)(uniqueMember=?)(memberUid=?))`. This option is ineffective unless the `enableCustomGroupFilter` option is set to true.
+
 ##### `enableNestedGroupFilter`
 
 _Optional, Default: `false`_