How does FOG know to use only ITStaff? The LDAP Group is that reference. Create an LDAP Group named ITStaff on your server, and give it a role on its Role Association tab. The Group Search DN only tells FOG where to look for groups. When a user signs in, FOG checks which of your LDAP Groups the user belongs to. A user in none of them gets no access.

That check runs only when Group Matching is ticked on the LDAP server. Please confirm it is ticked. When it is off, every account that can bind to your AD can sign in, and gets the fallback role (Technician by default).

Username: yes. Set User Name Attribute on the server to sAMAccountName, and users sign in with their plain AD username.

https://docs.fogproject.org/en/1.6/management/web/ldap/

In the past groups are just strings on a field.

Now with Role based access controls you can actually associate multiple groups to different roles so this was separated and done a bit differently.

2 seconds after I posted the below, I was able to login. I am going to test imaging now.

Getting closer, but something is still off. I felt like I had to add an AD group somewhere specifically, for example if the 3 IT staff are part of the “ITStaff” group, shouldn’t I reference that somewhere within FOG itself? Instead of it pointing directly to an OU that could contain many groups? How does it know to look in ITStaff only for the users?

How does it know where to choose from? Also, do i still use just the samAccountName to login with?

Sorry I know you are swamped with requests today most likely.

The group search DN is on the LDAP server, not on the LDAP Group. Open LDAP Management, pick your server, and set Group Search DN to the OU that holds your groups, for example OU=Groups,DC=campus,DC=edu. On the same page, Group Name Attribute is the attribute FOG matches the group name against. For AD, use cn.

An LDAP Group is only the group’s name, as that attribute holds it. For example, FOG Admins, not the full DN.

Then give the group access. Open the LDAP Group:

• Role Association tab: pick the role its members get.
• User Group Association tab: pick the FOG user group its members join.

A member of that AD group can then sign in with their AD username, and gets the access you associated.

Under LDAP Groups, it just asks for a common name. Am I supposed to do this in "LDAP Group User Group Associations? Or is that for something else?

I’m suspecting you just need to do the upgrade:

Plugin Management Page -> LDAP -> Update button.