--- a/etc/inc/auth.inc
+++ b/etc/inc/auth.inc
@@ -1410,13 +1410,20 @@
                }
                $ldapauthcont = $authcfg['ldap_authcn'];
                $ldapnameattribute = strtolower($authcfg['ldap_attr_user']);
+               $ldapgroupattribute = strtolower($authcfg['ldap_attr_member']);
                $ldapextendedqueryenabled = $authcfg['ldap_extended_enabled'];
                $ldapextendedquery = $authcfg['ldap_extended_query'];
                $ldapfilter = "";
                if (!$ldapextendedqueryenabled) {
                        $ldapfilter = "({$ldapnameattribute}={$username})";
                } else {
-                       $ldapfilter = "(&({$ldapnameattribute}={$username})({$ldapextendedquery}))";
+                       if (isset($authcfg['ldap_rfc2307'])) {
+                                       $ldapfilter = "({$ldapnameattribute}={$username})";
+                                       $ldapgroupfilter = "(&({$ldapgroupattribute}={$username})({$ldapextendedquery}))";
+                       } else {
+                               $ldapfilter = "(&({$ldapnameattribute}={$username})({$ldapextendedquery}))";
+                       }
+
                }
                $ldaptype = "";
                $ldapver = $authcfg['ldap_protver'];
@@ -1517,13 +1524,36 @@
                /* Support legacy auth container specification. */
                if (stristr($ldac_split, "DC=") || empty($ldapbasedn)) {
                        $search = @$ldapfunc($ldap, $ldac_split, $ldapfilter);
+
+                       if (isset($ldapgroupfilter)) {
+                               $groupsearch = @$ldapfunc($ldap, $ldac_split, $ldapgroupfilter);
+                       }
+
                } else {
                        $search = @$ldapfunc($ldap, $ldapsearchbasedn, $ldapfilter);
+
+                       if (isset($ldapgroupfilter)) {
+                               $groupsearch = @$ldapfunc($ldap, $ldapsearchbasedn, $ldapgroupfilter);
+                       }
                }
+
+               if (isset($ldapgroupfilter) && !$groupsearch) {
+                       log_error(sprintf(gettext("Extended group search resulted in error: %s"), ldap_error($ldap)));
+                       continue;
+               }
+
                if (!$search) {
                        log_error(sprintf(gettext("Search resulted in error: %s"), ldap_error($ldap)));
                        continue;
                }
+
+               if (isset($groupsearch)) {
+                       $validgroup = ldap_count_entries($ldap, $groupsearch);
+                       if ($debug) {
+                               log_auth(sprintf(gettext("LDAP group search: %s results."), $validgroup));
+                       }
+               }
+
                $info = ldap_get_entries($ldap, $search);
                $matches = $info['count'];
                if ($matches == 1) {
@@ -1563,9 +1593,18 @@
                log_auth(sprintf(gettext('Logged in successfully as %1$s via LDAP server %2$s with DN = %3$s.'), $username, $ldapname, $userdn));
        }
 
+       if ($debug && isset($ldapgroupfilter) && $validgroup < 1) {
+               $userdn = isset($authcfg['ldap_utf8']) ? utf8_decode($userdn) : $userdn;
+               log_auth(sprintf(gettext('Logged in successfully as %1$s but did not match any group in extended query.'), $username));
+       }
+
        /* At this point we are bound to LDAP so the user was auth'd okay. Close connection. */
        @ldap_unbind($ldap);
 
+       if (isset($ldapgroupfilter) && $validgroup < 1) {
+               return false;
+       }
+
        return true;
 }

--- a/usr/local/www/system_authservers.php
+++ b/usr/local/www/system_authservers.php
@@ -644,7 +644,7 @@
 $section->addInput(new Form_Checkbox(
        'ldap_extended_enabled',
        'Extended query',
-       'Enable extended query',
+       'Enable extended query for groups',
        $pconfig['ldap_extended_enabled']
 ));
 
@@ -656,7 +656,7 @@
        'Query',
        'text',
        $pconfig['ldap_extended_query']
-))->setHelp('Example: memberOf=CN=Groupname,OU=MyGroups,DC=example,DC=com');
+))->setHelp('Example (MSAD): memberOf=CN=Groupname,OU=MyGroups,DC=example,DC=com<br>Example (2307): |(&(objectClass=posixGroup)(cn=admin)(memberUid=*))(&(objectClass=posixGroup)(cn=anothergroup)(memberUid=*))');
 
 $section->add($group);

