How to get Active Directory Groups working with TikiWiki

So I have seen a number of questions revoloving around this issue, most get stuck authenticating against AD for login on TikiWiki. I have that working without issue.

The problem that I am facing is that there is supposed to be an integration with the Groups in AD so that I can assign privileges and access rights within the Tiki for those groups. Nothing that I have done allows me to pull in the group info, so I cannot segregate them apart without using internal (Tiki only) groups and assigning them after the users log in. In a large company that would be painfully tedious....

Here are screenshots of my LDAP tab and LDAP External Groups tab, sensitive info redacted of course. If I am missing something or have something misconfigured, please help. I followed the walk-through here to set everything up: https://tiki.org/forumthread42893. TikiWiki version is 15.2 (current stable)

LDAP Settings

LDAP External Group Settings

I finally figured that out. This works for me on Tikiwiki 16.2:

1. In General Preferences tab:

• Authentication method section, select Tiki and LDAP
• Uncheck Forgot password
• Uncheck Users can change their password

2. In LDAP tab, set up as following (you may need to switch the Advanced mode on to see more settings):

LDAP

• If user does not exist in Tiki: Create the user
• Uncheck Create user if not in LDAP
• Check Use Tiki authentication for Admin login

LDAP Bind settings

• Host: ldap://
• Port: 389
• Write LDAP debug Information in Tiki Logs:
• LDAP Bind Type: Active Directory (username@domain)
• Search scope: Subtree
• LDAP version: 3
• Base DN: DC=MYDOMAIN,DC=COM

LDAP User

• User DN: OU=All Users (If you want to pull users from a specific OU, if not, leave blank, also remember to omit the Base DN part)
• User attribute: sAMAccountName
• User OC: person
• Realname attribute: displayName
• Country attribute:
• Email attribute: userPrincipalName

LDAP Admin

• Admin user: admin@mydomain.com (in the form of @)
• Admin password:

3. In LDAP external groups tab, setup as following:

LDAP external groups

• Uncheck Use an external LDAP server for groups

LDAP Bind settings

• Host: ldap://
• Port: 389
• Check Write LDAP debug Information in Tiki Logs
• Uncheck Use SSL (ldaps) (Because I don't user SSL)
• Uncheck Use TLS (Because I don't use TLS)
• LDAP Bind Type: Active Directory (username@domain)
• Search scope: Subtree
• LDAP version: 3
• Base DN: DC=MYDOMAIN,DC=COM

LDAP User

• User DN: OU=All Users (If you want to pull users from a specific OU, if not, leave blank, also remember to omit the Base DN part)
• User attribute: sAMAccountName
• Corresponding user attribute in 1st directory: sAMAccountName
• User OC: person
• Check Synchronize Tiki groups with a directory (important)

LDAP Group

• Group DN: (Set Group DN to the specific OU you wish to pull groups from, ifyou wish to use the whole directory, leave blank. Note that as far as I can tell if you specify something here it will only pull from that specific OU, not members of that OU. For example a setting of ou=IT,ou=Authorized Users will pull groups from the Authorized Users\IT organizational unit, but will not pull from the Authorized Users\IT\Admins (ou=Admins,ou=IT,ou=Authorized Users) OU. There may be something to modify this behavior, but I haven't found it. Again, a blank setting will acquire all group information.)
• Group name attribute: sAMAccountName
• Group description attribute: description
• Group OC: group
• Check Synchronize Tiki users with a directory

LDAP Group Member - if group membership can be found in group attributes

• Member attribute: member
• Check Member is DN

LDAP User Group - if group membership can be found in user attributes

• Group attribute: memberOf
• Group attribute in group entry: cn

LDAP Admin

• Admin user: admin@mydomain.com (in the form of @)
• Admin password:

4. Click Apply and enjoy

From now on, whenever a user login, all the groups where she belongs will be created on Tikiwiki if they aren't there yet.

I also wrote an article here: http://www.dangtrinh.com/2017/04/ldap-authentication-with-active.html