Hi,
I understand that Splunk 4.3.3 should support nested groups in Active Directory, according to this document. However, I'm unable to get it working. I have set nestedGroups=1
. I've also set groupMemberAttribute=member
, (and tried without it as well), but it still won't work.
Currently, I'm only testing this with one nested group.
CN=it-infrastructure,OU=SPLUNK,OU=Application Groups,OU=Groups,DC=company,DC=domain,DC=tld
which has a member:
CN=infrastructure-internal,OU=Organisational Groups,OU=Managed Groups,OU=Groups,DC=company,DC=domain,DC=tld
# authentication.conf:
[AD]
SSLEnabled = 0
anonymous_referrals = 1
bindDN = cn=svc-splunk-01,ou=Splunk,ou=Service Accounts,ou=Other Accounts,dc=company,dc=domain,dc=tld
bindDNpassword = snafu
charset = utf8
dynamicMemberAttribute = member
groupBaseDN = ou=SPLUNK,ou=Application Groups,ou=Groups,dc=company,dc=domain,dc=tld
groupBaseFilter = (objectclass=*)
groupMappingAttribute = dn
groupMemberAttribute = member
groupNameAttribute = cn
host = ldap.company.domain.tld
nestedGroups = 1
network_timeout = 20
port = 389
realNameAttribute = cn
sizelimit = 1000
timelimit = 15
userBaseDN = ou=Departments,dc=company,dc=domain,dc=tld
userBaseFilter = (objectclass=*)
userNameAttribute = samaccountname
Now looking at the configuration, I'm wondering if the problem may be the groupBaseDN
setting. This matches the parent group, but not the nested group. Is this the problem? If I widen it to just ou=Groups,dc=...
, I get 1000+ groups, which is quite a lot, but I'm not sure if it's a problem. So, does the nested group also have to match the groupBaseDN?
Widen the groupBaseDN
- it shouldn't be a problem. If you're worried, add to the groupBaseFilter
to just look at those in the right OUs.
Widen the groupBaseDN
- it shouldn't be a problem. If you're worried, add to the groupBaseFilter
to just look at those in the right OUs.
Glad to hear it worked out!
Thanks!
Yes, I was worried about the amount of groups listed and I tried out several combinations of values for groupBaseFilter
and dynamicGroupFilter
. Either I couldn't get it to authenticate or the list of groups.
Thanks to your suggestion, I set both to the same value and it does work. Authentication works and the list is nice and small, so thank you very much!