AD nested groups

[Fisher, Daniel]

Dear List,

until recently, we used to add a

followReferrals="true"

to the LDAP DataConnector and we could see the AD nested groups. Or we added a separate "myGroups" DataConnector using the extended Filter as in https://shibboleth.net/pipermail/users/2020-March/046262.html

This does not seem to work anymore, for some months we've seen more and more deployments where this fails. Is anybody aware of that? Were there changes in the AD deployments allover the globe? Does anyone have a solution to get these nested groups with the Shibboleth IdP?


What version of the IDP are you running?

Are you setting followReferrals=“true” directly on the <DataConnector/> configuration?

If you post your (redacted) configuration here I can review it.

--Daniel Fisher

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20260419/79d9034a/attachment.htm>