adauth.AuthenticateExtended call is not returning an expected ldap group about go-ad-auth HOT 1 CLOSED

By default, Domain Users is the primary group for users. This means a user's primaryGroupID attribute is set to the RID of the group. The group won't show up in the generated memberOf attribute of the user, and the user won't show up in the member attribute of the group.

Matching against the default group, while a valid use case, seems not to be useful to most. Unless you're doing something weird, every user that's able to authenticate will also be a part of that group. Checking if one of the groups passed to AuthenticateExtended is the primary group would add an extra LDAP query for every call. I'm not going to do that because most users would find it necessary.

Instead, in version v3.2.0, I've added *Conn.ObjectPrimaryGroup, which you can use to manually check yourself:

dn, err := conn.ObjectPrimaryGroup("cn", "John Smith")
if err != nil {
    // handle err
}

if dn != expectedGroup {
    // handle mismatch
}

from go-ad-auth.