LDAP Authentication Issue in Wiki.js with Active Directory Users Restricted by Login Permissions

[coca-mann]

Hello, I'm experiencing an issue when attempting to authenticate regular Active Directory (AD) users in Wiki.js using the LDAP strategy. Currently, the Wiki.js server tries to authenticate directly to the domain controller, but the login fails due to login restrictions set in AD. These restrictions limit the computers on which regular users are allowed to log in, and the AD server is not included in the list of allowed computers for these users.

Steps to Reproduce:

1. Configure LDAP authentication in Wiki.js.
2. Attempt to log in with a regular AD user who has login restrictions configured.
3. Receive an error message indicating that the user is not authorized to log in to the domain controller.

Expected Behavior:

Regular AD users should be able to authenticate on Wiki.js using LDAP, regardless of login restrictions configured on the domain controller.

Observed Error:

Here is an example of the error log generated on the domain controller:

Logon failure.

Account Information:
  Security ID:   SYSTEM
  Account Name:  PVH01DC01$
  Account Domain:  GAC
  Logon ID:   0x3E7

Logon Type:   3

Failed Account:
  Security ID:   NULL SID
  Account Name:   ti
  Account Domain:   GAC

Failure Information:
  Failure Reason:   User not allowed to logon to this computer.
  Status:   0xC000006E
  Substatus:   0xC0000070

Process Information:
  Caller Process ID: 0x3f4
  Caller Process Name:   C:\Windows\System32\lsass.exe

Network Information:
  Workstation Name:   PVH01DC01
  Source Network Address:   172.16.0.250
  Source Port:   52528

Attempted Solutions:

1. Remove login restrictions for regular AD users - This works but compromises security.
2. Add the Wiki.js server to the list of allowed computers for regular users - This may work but requires frequent updates if there are changes.

Question:

Is there a setting in Wiki.js or an LDAP authentication alternative that would allow Wiki.js to authenticate without requiring the server to log in directly to the domain controller? Any suggestions or workarounds would be greatly appreciated!