# \[Pro\] \[Ldap\] How to configure the Ldap connector to add users to groups without the group manager manual intervention?

**URL:** <https://community.passbolt.com/t/pro-ldap-how-to-configure-the-ldap-connector-to-add-users-to-groups-without-the-group-manager-manual-intervention/2741>\
**Category:** Community Feedback\
**Tags:** ldap\
**Created:** [May 12, 2020, 1:18pm UTC](https://community.passbolt.com/t/pro-ldap-how-to-configure-the-ldap-connector-to-add-users-to-groups-without-the-group-manager-manual-intervention/2741 "2020-05-12T13:18:46Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![audebraf86r](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/audebraf86r/32/1197_2.png) [@audebraf86r](https://community.passbolt.com/u/audebraf86r)\
**Post date:** [May 12, 2020, 1:18pm UTC](https://community.passbolt.com/t/pro-ldap-how-to-configure-the-ldap-connector-to-add-users-to-groups-without-the-group-manager-manual-intervention/2741/1 "2020-05-12T13:18:46Z")

</div>

Hi there.

My organization use a specific LDAP branch to feed Passbolt groups and users. This works fine ☀

But…

Users and groups are finely synch in Passbolt when there’s no secrets shared, but when 1 share 1 secret to a group, the synch script send email to group manager, asking a manual operation. It says :

`A request to add user laurence[xxxx].fr in group equipe-xxx was sent to the group manager.`

Is it possible to allow group filling w/o this ? I browsed ldap.php file but didn’t find option to.

Thank for help

---

<div class="post-metadata">

**Author:** ![kevin](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/kevin/32/128_2.png) [@kevin](https://community.passbolt.com/u/kevin)\
**Post date:** [May 13, 2020, 9:33am UTC](https://community.passbolt.com/t/pro-ldap-how-to-configure-the-ldap-connector-to-add-users-to-groups-without-the-group-manager-manual-intervention/2741/2 "2020-05-13T09:33:23Z")

</div>

Hi @audebraf86r,

Welcome to the community.

The reason why the ldap connector behaves this way is due to the end-to-end nature of Passbolt. The connector doesn’t have a private key, nor can access to the secrets stored in the database. Consequently, since it cannot decrypt the secrets it cannot re-encrypt them for users that are added to a group with passwords shared with it, and needs to send a notification to the group manager to do it manually.

We have plans to improve this in a near future by managing user accesses to the secrets in a more asynchronous way.

Hope this answers your question.

---

<div class="post-metadata">

**Author:** ![audebraf86r](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/audebraf86r/32/1197_2.png) [@audebraf86r](https://community.passbolt.com/u/audebraf86r)\
**Post date:** [May 14, 2020, 1:49pm UTC](https://community.passbolt.com/t/pro-ldap-how-to-configure-the-ldap-connector-to-add-users-to-groups-without-the-group-manager-manual-intervention/2741/3 "2020-05-14T13:49:35Z")

</div>

Hi @kevin,

Thank you for this clear explanation.

I’ll notice users they should ensure maximum of users are synch before start populate Passbolt.

This topic can be closed 🙂

Best regards

---

<div class="post-metadata">

**Author:** ![kevin](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/kevin/32/128_2.png) [@kevin](https://community.passbolt.com/u/kevin)\
**Post date:** [May 14, 2020, 2:35pm UTC](https://community.passbolt.com/t/pro-ldap-how-to-configure-the-ldap-connector-to-add-users-to-groups-without-the-group-manager-manual-intervention/2741/4 "2020-05-14T14:35:01Z")

</div>