[](https://www.gnu.org/licenses/agpl)
Adds user accounts to groups based on rules defined by the administrator.
auto_awesome What this module does
AI-generated from the code · Odoo 17.0Lets administrators map LDAP directory attributes to Odoo groups, so users logging in via LDAP are automatically placed in the right groups, optionally keeping group membership strictly in sync with LDAP.
This module extends the LDAP server configuration in Odoo so administrators can define rules that assign Odoo groups to users based on their LDAP directory attributes.
On the LDAP server form (Settings / LDAP), a new "Map User Groups" section appears. There you can add group mappings: each mapping checks an LDAP attribute (for example memberOf in Active Directory) with an operator (contains, equals, or query) against a value, and assigns a chosen Odoo group when it matches.
A checkbox "Only LDAP groups" controls synchronisation. When checked, every login removes all existing groups from the user and re-applies only the groups matched by the mappings, so manual group changes are undone. When unchecked, manually added groups are preserved and mapped groups are simply added.
If "Only LDAP groups" is enabled, the system verifies that exactly one of the essential user-type groups (Internal User, Portal, or Public) is assigned; otherwise it raises an error and the login fails.
The module also hooks into the login process: when a user logs in and any LDAP configuration has "Only LDAP groups" enabled, the user's groups are refreshed from LDAP at that moment. It touches the LDAP configuration model (res.company.ldap), the user model (res.users), and adds a new mapping model (res.company.ldap.group_mapping).
Depends on
Models and fields (3)
- res.company.ldap · extends an existing modelonly_ldap_groups (Only LDAP groups), group_mapping_ids
- res.company.ldap.operator · new model
- res.company.ldap.group_mapping · new modelvalue, ldap_id, group_id, operator, ldap_attribute (LDAP attribute)
Text generated by AI (DeepSeek) from reading the Odoo 17.0 code on GitHub; it may contain mistakes, so check the code before deciding. View the code on GitHub
Availability by version
Reviewed: 2026-11-03Confirmation status: 6 confirmed, 3 with no information of 9 versions.
Sources · Odoo 17.0
Confirmed on 2026-11-03 in branch 17.0 of OCA/server-auth.
terminal Installation and usage
OCA documentation · Odoo 17.0Usage
Source · Odoo 17.0Define mappings in Settings / General Settings / Integrations / LDAP Authentication / LDAP Server
Decide whether you want only groups mapped from LDAP (Only LDAP groups checked) or a mix of manually set groups and LDAP groups (Only LDAP groups unchecked). Setting this to "no" will result in users never losing privileges when you remove them from a LDAP group, so that's a potential security issue. It is still the default to prevent losing group information by accident. If set to "Yes", you need to make sure each user has at least on of the "User types" groups
For active directory, use LDAP attribute 'memberOf' and operator 'contains'. Fill in the DN of the windows group as value and choose an Odoo group users with this windows group are to be assigned to.
For posix accounts, use operator 'query' and a value like:
(&(cn=bzr)(objectClass=posixGroup)(memberUid=$uid))
The operator query matches if the filter in value returns something, and value can contain $attribute which will be replaced by the first value of the user's LDAP record's attribute named attribute.
No verified information in OCA: Installation, Configuration.
Installation instructions, the distribution package, dependencies and configuration steps are not shown because they have not yet been verified in the module documentation for any version.
Data imported from GitHub: this sheet reflects the latest catalog review, not a live lookup. Always check the module documentation and staging before installing in production.