Just a reminder for myself, or other people in need in the future
thanks again for all people who helped me understanding this
Had to reinstall my entire XCP system, and almost forget how to configure Ldap plugin to only allow my admin accout to login
So here's my Ldap plugin conf, to allow only admin user (member of specific group) to login.
my AD is a windows 2K19 server with active directory without ssl.
URI : ldap://dc.domain.net:389
no certificate info
base : dc=domain,dc=net
Credential : Fill = tick
DN = full DN of service user (CN=xen,OU=service_account,DC=domain,DC=net)
password = password of this account
it's a simple account with no specific right, can only read AD and login
User Filter, where it can stuck
(&(sAMAccountName={{name}})(memberOf=CN=SG-XCP_Admin,OU=service_account,DC=domain,DC=net))
in real my OU have spaces inside their name, it work anyway.
SG-XCP_Admin is a security group having my admin users inside
ID Attribute : sAMAccountName
and that's all.