multiple groups in OU

[schmel]

Hi, I have group in AD: CN=asterisk_rec,OU=Asterisk,OU=учетные записи и группы,DC=test,DC=int

My work nginx config:

    location /login {
       proxy_pass http://auth-backend/login;
       proxy_set_header X-Target $request_uri;
    }

    location = /auth-proxy {
       internal;
       proxy_pass http://127.0.0.1:8888; # сервер аутентификации

       proxy_pass_request_body off;
       proxy_set_header Content-Length "";
 
       proxy_set_header X-Ldap-URL      "ldap://dc01:389";
       proxy_set_header X-Ldap-DisableReferrals "true";
       proxy_set_header X-Ldap-BaseDN   "DC=test,DC=int"; 
       proxy_set_header X-Ldap-BindDN   "ad_read@test.int";
       proxy_set_header X-Ldap-BindPass "Mdfdfdfdfdfdf";
       proxy_set_header X-CookieName "nginxauth";
       proxy_set_header Cookie nginxauth=$cookie_nginxauth;

       proxy_set_header X-Ldap-Template "(&(sAMAccountName=%(username)s)(memberOf=CN=asterisk_rec,OU=Asterisk,OU=учетные записи и группы,DC=test,DC=int)(objectClass=user))";
     }

It works. But, when i create multiple groups in OU (Asterisk) and subdomains configs in nginx (new server port, root directory and X-Ldap-Template), i can not login in all sites with nginx-ldap-auth. In logs:

localhost - asterisk [24/Jun/2019 15:27:46] searching on server "ldap://dc01:389" with base dn "DC=test,DC=int" with filter "(&(sAMAccountName=asterisk)(objectClass=user)(memberOf=CN=asterisk_rec_sd,OU=Asterisk,OU=учетные записи и группы,DC=test,DC=int))"
localhost - asterisk [24/Jun/2019 15:27:46] note: filter match multiple objects: 3, using first
localhost - asterisk [24/Jun/2019 15:27:46] Error while verifying search query results: matched object has no dn, server="ldap://dc01:389", login="asterisk"
localhost - asterisk [24/Jun/2019 15:27:46] "GET /auth-proxy HTTP/1.0" 401 -

[schmel]

Hmm, maybe trouble in Template string. I copy search string from windows ldap admin (one to one in nginx conf), in nginx config, and it worked.