multiotp ad sync limit issue - Built-in "Domain Users" cannot be used as a selection group.

[RIS8C8]

Good day,

I am writing to you for an issue we encountered with the new OTP-in feature in the open-source version of multiOTP 5.10.2.2.

After installation, we ran the AD synchronization using the command: multiotp -debug -display-log -ldap-users-sync

We configured the “Domain Users” group as the ‘Without2FA’ group and the "otp" as the otp-in group for users requiring two-factor authentication.

However, after executing the sync command, the system detects only users of the “otp” group.

We have noticed that when using smaller groups for the ‘Without2FA’ group (even if they contain other subgroups), synchronization works correctly for all users.

Are there any limitations on the number of users that can be synchronized or are there specific configurations we need to check to manage large groups such as “Domain Users”?

Our goal is to apply two-factor authentication exclusively to the few users in the “otp” group.

Regards.

[multiOTP]

Hello,
"Domain Users" is a special built-in Active Directory group which cannot be used to filter users in our library. You have to create a specific group in order to filter them.
This is by design, in order to prevent BAD security issues with built-in Active Directory groups.
If you want to set a 2FA authentication to everybody, you can leave the OTP groups empty, but you cannot leave empty or put a built-in Active Directory group for Without2FA users.
Regards,