Security

Active Directory nested groups

echalex
Builder

Hi,

I understand that Splunk 4.3.3 should support nested groups in Active Directory, according to this document. However, I'm unable to get it working. I have set nestedGroups=1. I've also set groupMemberAttribute=member, (and tried without it as well), but it still won't work.

Currently, I'm only testing this with one nested group.

CN=it-infrastructure,OU=SPLUNK,OU=Application Groups,OU=Groups,DC=company,DC=domain,DC=tld

which has a member:

CN=infrastructure-internal,OU=Organisational Groups,OU=Managed Groups,OU=Groups,DC=company,DC=domain,DC=tld

# authentication.conf:
[AD]
SSLEnabled = 0
anonymous_referrals = 1
bindDN = cn=svc-splunk-01,ou=Splunk,ou=Service Accounts,ou=Other Accounts,dc=company,dc=domain,dc=tld
bindDNpassword = snafu
charset = utf8
dynamicMemberAttribute = member
groupBaseDN = ou=SPLUNK,ou=Application Groups,ou=Groups,dc=company,dc=domain,dc=tld
groupBaseFilter = (objectclass=*)
groupMappingAttribute = dn
groupMemberAttribute = member
groupNameAttribute = cn
host = ldap.company.domain.tld
nestedGroups = 1
network_timeout = 20
port = 389
realNameAttribute = cn
sizelimit = 1000
timelimit = 15
userBaseDN = ou=Departments,dc=company,dc=domain,dc=tld
userBaseFilter = (objectclass=*)
userNameAttribute = samaccountname

Now looking at the configuration, I'm wondering if the problem may be the groupBaseDN setting. This matches the parent group, but not the nested group. Is this the problem? If I widen it to just ou=Groups,dc=..., I get 1000+ groups, which is quite a lot, but I'm not sure if it's a problem. So, does the nested group also have to match the groupBaseDN?

1 Solution

dart
Splunk Employee
Splunk Employee

Widen the groupBaseDN - it shouldn't be a problem. If you're worried, add to the groupBaseFilter to just look at those in the right OUs.

View solution in original post

dart
Splunk Employee
Splunk Employee

Widen the groupBaseDN - it shouldn't be a problem. If you're worried, add to the groupBaseFilter to just look at those in the right OUs.

dart
Splunk Employee
Splunk Employee

Glad to hear it worked out!

0 Karma

echalex
Builder

Thanks!
Yes, I was worried about the amount of groups listed and I tried out several combinations of values for groupBaseFilter and dynamicGroupFilter. Either I couldn't get it to authenticate or the list of groups.

Thanks to your suggestion, I set both to the same value and it does work. Authentication works and the list is nice and small, so thank you very much!

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...