Active Directory nested groups

[echalex]

Hi,

I understand that Splunk 4.3.3 should support nested groups in Active Directory, according to this document. However, I'm unable to get it working. I have set nestedGroups=1. I've also set groupMemberAttribute=member, (and tried without it as well), but it still won't work.

Currently, I'm only testing this with one nested group.

CN=it-infrastructure,OU=SPLUNK,OU=Application Groups,OU=Groups,DC=company,DC=domain,DC=tld

which has a member:

CN=infrastructure-internal,OU=Organisational Groups,OU=Managed Groups,OU=Groups,DC=company,DC=domain,DC=tld

# authentication.conf:
[AD]
SSLEnabled = 0
anonymous_referrals = 1
bindDN = cn=svc-splunk-01,ou=Splunk,ou=Service Accounts,ou=Other Accounts,dc=company,dc=domain,dc=tld
bindDNpassword = snafu
charset = utf8
dynamicMemberAttribute = member
groupBaseDN = ou=SPLUNK,ou=Application Groups,ou=Groups,dc=company,dc=domain,dc=tld
groupBaseFilter = (objectclass=*)
groupMappingAttribute = dn
groupMemberAttribute = member
groupNameAttribute = cn
host = ldap.company.domain.tld
nestedGroups = 1
network_timeout = 20
port = 389
realNameAttribute = cn
sizelimit = 1000
timelimit = 15
userBaseDN = ou=Departments,dc=company,dc=domain,dc=tld
userBaseFilter = (objectclass=*)
userNameAttribute = samaccountname

Now looking at the configuration, I'm wondering if the problem may be the groupBaseDN setting. This matches the parent group, but not the nested group. Is this the problem? If I widen it to just ou=Groups,dc=..., I get 1000+ groups, which is quite a lot, but I'm not sure if it's a problem. So, does the nested group also have to match the groupBaseDN?

[dart · Accepted solution]

Widen the groupBaseDN - it shouldn't be a problem. If you're worried, add to the groupBaseFilter to just look at those in the right OUs.

[dart]

Glad to hear it worked out!

[echalex]

Thanks!
Yes, I was worried about the amount of groups listed and I tried out several combinations of values for groupBaseFilter and dynamicGroupFilter. Either I couldn't get it to authenticate or the list of groups.

Thanks to your suggestion, I set both to the same value and it does work. Authentication works and the list is nice and small, so thank you very much!