When LDAP login works but group lookup fails

Symptom: the user can authenticate (username and password accepted), but the application cannot fetch group membership. That usually means the bind works, but the search fails.

Fast isolation checklist

1. DNS first: confirm the HMI can resolve the domain controller FQDN and reach it.
2. Time sync: if time drift is large, TLS or Kerberos style flows can break.
3. Bind user: verify the bind DN format expected by the application.
4. Search base DN: wrong base DN returns zero objects even though bind succeeds.
5. Group filter: confirm the group objectClass and membership attribute.
6. Permissions: does the bind account have rights to read groups?

Minimal test queries

Use a known-good tool to validate LDAP search outside the HMI if possible.

# Example (conceptual):
Base DN: DC=example,DC=com
User filter: (&(objectClass=user)(sAMAccountName=YOURUSER))
Group filter: (&(objectClass=group)(cn=YOURGROUP))

What to capture for evidence

• HMI logs showing bind success and group search failure
• DNS settings, gateway settings, and ping / name resolution results
• Exact base DN and filter strings used
• Timestamped screenshots

Next: replace the placeholders with your real environment and record the final working configuration.