Security

Active Directory nested groups

echalex
Builder

Hi,

I understand that Splunk 4.3.3 should support nested groups in Active Directory, according to this document. However, I'm unable to get it working. I have set nestedGroups=1. I've also set groupMemberAttribute=member, (and tried without it as well), but it still won't work.

Currently, I'm only testing this with one nested group.

CN=it-infrastructure,OU=SPLUNK,OU=Application Groups,OU=Groups,DC=company,DC=domain,DC=tld

which has a member:

CN=infrastructure-internal,OU=Organisational Groups,OU=Managed Groups,OU=Groups,DC=company,DC=domain,DC=tld

# authentication.conf:
[AD]
SSLEnabled = 0
anonymous_referrals = 1
bindDN = cn=svc-splunk-01,ou=Splunk,ou=Service Accounts,ou=Other Accounts,dc=company,dc=domain,dc=tld
bindDNpassword = snafu
charset = utf8
dynamicMemberAttribute = member
groupBaseDN = ou=SPLUNK,ou=Application Groups,ou=Groups,dc=company,dc=domain,dc=tld
groupBaseFilter = (objectclass=*)
groupMappingAttribute = dn
groupMemberAttribute = member
groupNameAttribute = cn
host = ldap.company.domain.tld
nestedGroups = 1
network_timeout = 20
port = 389
realNameAttribute = cn
sizelimit = 1000
timelimit = 15
userBaseDN = ou=Departments,dc=company,dc=domain,dc=tld
userBaseFilter = (objectclass=*)
userNameAttribute = samaccountname

Now looking at the configuration, I'm wondering if the problem may be the groupBaseDN setting. This matches the parent group, but not the nested group. Is this the problem? If I widen it to just ou=Groups,dc=..., I get 1000+ groups, which is quite a lot, but I'm not sure if it's a problem. So, does the nested group also have to match the groupBaseDN?

1 Solution

dart
Splunk Employee
Splunk Employee

Widen the groupBaseDN - it shouldn't be a problem. If you're worried, add to the groupBaseFilter to just look at those in the right OUs.

View solution in original post

dart
Splunk Employee
Splunk Employee

Widen the groupBaseDN - it shouldn't be a problem. If you're worried, add to the groupBaseFilter to just look at those in the right OUs.

dart
Splunk Employee
Splunk Employee

Glad to hear it worked out!

0 Karma

echalex
Builder

Thanks!
Yes, I was worried about the amount of groups listed and I tried out several combinations of values for groupBaseFilter and dynamicGroupFilter. Either I couldn't get it to authenticate or the list of groups.

Thanks to your suggestion, I set both to the same value and it does work. Authentication works and the list is nice and small, so thank you very much!

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...