LDAP login fails with "not in LDAP sync groups" when using Samba/Synology AD

[d4rkbl00d]

Environment:
Defguard version: 2.0.2
LDAP server: Synology Directory Server (Samba-based Active Directory)
Deployment: Docker on Synology NAS

Description:
LDAP authentication fails at login even though the user is a member of the configured sync group. The LDAP bind test succeeds but the group membership check fails.

Logs:
LDAP bind test for user CN=testuser,CN=Users,DC=lab,DC=local successful
User testuser is not in LDAP sync groups, not allowing to login through LDAP.

LDAP Config:
LDAP server is Active Directory: ✅
Username attribute: sAMAccountName
Member attribute: memberOf
Group member attribute: member
Limit sync to groups: Defguard

Verified:
member attribute of group contains correct DNs
memberOf on user object contains CN=Defguard,CN=Users,DC=lab,DC=local
LDAP bind succeeds
Group sync filter generates wrong query: (&(objectClass=group)(cn=DC=local)) instead of (&(objectClass=group)(cn=Defguard))

Suspected bug: Group name parsing issue - when full DN is entered it parses incorrectly, when only CN is entered the group membership check still fails at login.

Can anyone help me, with my problem?

[d4rkbl00d]

Things I checked / Additional context:
Enrollment + Login flow unclear for LDAP users:
It is unclear whether LDAP users need to complete enrollment before being able to log in to the Defguard web UI with their LDAP credentials.
Current observed behavior:

Without enrollment: Login to web UI fails with "not in LDAP sync groups" (see above)
With enrollment: Enrollment wizard forces setting a new Defguard-internal password
After enrollment with new password: Login works but uses the new internal password, NOT the LDAP/AD password

This creates a confusing and broken flow:

If enrollment is required before LDAP login works → enrollment should NOT ask for a new password but use AD credentials instead
If LDAP login should work without enrollment → the group membership check is broken (main bug above)

Expected flow for LDAP users:

Admin syncs users from AD via LDAP
User opens Defguard web UI or desktop client
User logs in with their existing AD username + password
No separate password creation required

Is enrollment even required for LDAP users?