I have member_of = "cn" because of this part of the config file:
# In POSIX LDAP schemas, without memberOf attribute a secondary query must be made for groups.
# This is done by enabling group_search_filter below. You must also set member_of= "cn"
# in [servers.attributes] below.
As that is true for my environment.
I tried removing the wildcard, but my explicit rule still fails to math. So I get authenticated, but am still unauthorized, it acts as if I belong to no organizations.
I had those lines commented because my understanding is those were the default values that were being set anyway. I did try uncommenting them just now but there was no change in behavior
Thanks for helping take a look at it.