LDAP: How to disable local password authentication for specific users

Support
1

Operating system

Linux

Joplin version

3.7.2

Sync target

Joplin Server

Editor

Markdown Editor

What issue do you have?

Question

I've recently set up LDAP authentication on my Joplin Server and it's working well — users can now log in with their LDAP credentials. However, I have two issues:

1. Local password fallback for LDAP users

Currently, even after a user has successfully authenticated via LDAP, they can still fall back to their local password if LDAP fails. I want to prevent this for certain users — they should only be able to log in via LDAP, not with a local password.

This would help enforce that specific users (e.g., those managed by Active Directory) cannot bypass LDAP authentication.

2. LDAP filtering by user group or attribute

Is there a way to use LDAP filters to restrict login to users belonging to a specific group or having certain attributes? For example:

  • Only allow users in an Active Directory group like cn=joplin-users,ou=groups,dc=example,dc=com
  • Or filter by department or custom LDAP attributes

Current behavior

  • LDAP authentication works, but there's always a local password fallback
  • No per-user or per-group filtering mechanism visible in the code

What I'm looking for

  1. A way to mark certain users as "LDAP-only" (perhaps via a database flag or configuration)
  2. Optional: LDAP group/filter support to restrict authentication based on directory structure

Is this something that's currently possible, or would it require code modifications?