Skip to content

Hosts / Active Directory OU Browser Selection #1879

Closed
Closed
Hosts / Active Directory OU Browser Selection#1879
Labels
enhancementready-for-humanNeeds hardware/env repro, infra access, or a product/design decision

Description

@flagoda
flagoda
opened on Oct 16, 2026

Hi,
I would like to suggest an improvement to the Host Management / Active Directory section to make domain and Organizational Unit (OU) selection easier.

Currently, users have to manually enter the Domain Name and the full LDAP path of the Organizational Unit.

It would be very useful to have a selectable OU browser, accessible through a button or clickable field next to the Organizational Unit field.

The idea would be to:

-Configure one or multiple Active Directory domains in the FOG settings.

-Configure a dedicated read-only Active Directory service account for each domain (or an account with access to multiple domains).

-Automatically retrieve the list of available Organizational Units OU and their sub-OUs from Active Directory, optionally starting from a specific base OU (e.g., OU=xxx).

-Display these OUs in a searchable list or hierarchical tree, similar to a small Active Directory browser.

-Allow users to select an OU, automatically filling in both the Domain Name and Organizational Unit fields with the correct values.

Ideally, this OU browser would not require any additional permissions beyond read-only access to Active Directory.

Activity

  1. mastacontrola
    added
    enhancement
    ready-for-humanNeeds hardware/env repro, infra access, or a product/design decision
    on Oct 16, 2026

  2. mastacontrola commented on Oct 16, 2026

    @mastacontrola
    mastacontrola
    on Oct 16, 2026
    Member

    Design agreed for this request. It replaces the ou plugin with a new plugin, working name Directory Groups (directorygroups).

    Plugin (directorygroups)

    • Keeps a list of domains. Each domain has its own server URI, read-only bind account, password, base DN and CA certificate.
    • Browses the OUs of each domain, from a configurable base OU, as a searchable tree.
    • Selecting an OU fills both the host's Domain Name and Organizational Unit fields.
    • Groups hosts by OU. This replaces the ou plugin's hand-entered OU list. Existing ou rows and host links are migrated on install.
    • Scope is OUs only. Security-group membership is not part of this request.

    Core

    • Without the plugin, nothing changes. Placement uses the single FOG_DIRECTORY_* connection.
    • Two small hooks are added:
      • Placement fires an event before it connects, so the plugin can supply the connection for the host's domain.
      • The FOG Settings page fires an event that lets a plugin hide settings it replaces. When the plugin is installed, the FOG_DIRECTORY_* fields are hidden and the plugin's domain list is shown. When it is uninstalled, they come back.
    • On install, the plugin copies the current FOG_DIRECTORY_* connection in as its first domain.
  3. mastacontrola
    added a commit that references this issue on Oct 16, 2026

    List a domain's OUs, and declare the Directory Groups tables' keys

    a96364a

  4. mastacontrola commented on Oct 16, 2026

    @mastacontrola
    mastacontrola
    on Oct 16, 2026
    Member

    Shipped on working-1.6 and rc-1.6.0.

    The ou plugin stays installed after an upgrade. Install Directory Groups first, so it copies the ou data, then uninstall ou.

  5. mastacontrola
    closed this as completedon Oct 16, 2026

  6. mastacontrola commented on Oct 16, 2026

    @mastacontrola
    mastacontrola
    on Oct 16, 2026
    Member

    Correction to the design above: the bind account is not read-only when placement is on.

    • Browsing OUs (domain Organizational Units tab, host Browse Directory) needs read access only.
    • Placement moves the computer account with an LDAP Modify DN. That needs Delete Computer objects on the OUs a host can leave and Create Computer objects on the OUs it can go to.
    • With a read-only account, browsing works and you can save an OU on the host. Placement then fails, the computer account stays where it is, and the Directory Membership report shows the error per host.
    • A read-only account is enough only when FOG_DIRECTORY_PLACEMENT_ENABLED is off.

    Documented in FOGProject/fog-docs#200.

  7. mastacontrola
    added 2 commits that reference this issue on Oct 16, 2026

    Fire ASSOCIATION_UPDATED, and declare directoryOUs.doGroupID

    272ff11

    Pin fog-plugins v1.6.26

    3f73099

  8. mastacontrola commented on Oct 16, 2026

    @mastacontrola
    mastacontrola
    on Oct 16, 2026
    Member

    Follow-up shipped: each directory group is now a core group.

    • A host in a directory group gets everything its core group grants: snapins, printers, modules and power schedules.
    • A host is in one directory group at a time. Joining one on any page removes the host from the other.
    • Joining writes the OU, and the domain when the group has one, onto the host. Leaving changes nothing on the host.

    Shipped in:

    A join account per domain is tracked in #1887.

  9. mastacontrola
    added a commit that references this issue on Oct 16, 2026

    Release candidate 1.6.0-RC-13

    6fa03e9
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementready-for-humanNeeds hardware/env repro, infra access, or a product/design decision

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions