AD nested groups

[Martin Hitschel]

Hi Daniel,

I see this with several customers, most of them run 5.2.x, some 5.1.6.

My documentation states this should spit out memberOfs for nested 
groups, at least that used to work before:

    <DataConnector id="myLDAP" xsi:type="LDAPDirectory"
        ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"
        baseDN="%{idp.attribute.resolver.LDAP.baseDN}"
        principal="%{idp.attribute.resolver.LDAP.bindDN}"
        principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}"
        useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS:true}"
        connectTimeout="%{idp.attribute.resolver.LDAP.connectTimeout}"
        trustFile="%{idp.attribute.resolver.LDAP.trustCertificates}"
*followReferrals="true"* exportAttributes="mail givenName sn cn *memberOf*"
        responseTimeout="%{idp.attribute.resolver.LDAP.responseTimeout}">
        <FilterTemplate>
            <![CDATA[
                %{idp.attribute.resolver.LDAP.searchFilter}
            ]]>
        </FilterTemplate>
    </DataConnector>

with idp.attribute.resolver.LDAP.searchFilter        = 
(sAMAccountName=$resolutionContext.principal)

At least with an extra connector we should be getting the nested groups:

    <DataConnector id="myLDAPGroups" xsi:type="LDAPDirectory"
        ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"
        baseDN="%{idp.attribute.resolver.LDAP.baseDN}"
        principal="%{idp.attribute.resolver.LDAP.bindDN}"
        principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}"
        useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS:true}"
        connectTimeout="%{idp.attribute.resolver.LDAP.connectTimeout}"
        responseTimeout="%{idp.attribute.resolver.LDAP.responseTimeout}"
*followReferrals="true"* 
trustFile="%{idp.attribute.resolver.LDAP.trustCertificates}"
        maxResultSize="0">
      <InputDataConnector ref="myLDAP" attributeNames="distinguishedName"/>
      <FilterTemplate>
        <![CDATA[
*(member:1.2.840.113556.1.4.1941:=$distinguishedName.get(0))*
        ]]>
      </FilterTemplate>
      <ReturnAttributes>
        distinguishedName
      </ReturnAttributes>
    </DataConnector>

with

  <AttributeDefinition id="memberOf" xsi:type="Simple">
        <InputDataConnector ref="myLDAPGroups" 
attributeNames="distinguishedName"/>
    </AttributeDefinition>

This started failing maybe a year ago or so throughout most AD 
customers. So I believe there came a new AD default setting along. I 
remember on customer working with us and experimenting with their AD 
settings, but the best we could get were timeouts, even up to 30 seconds 
without result.

My gut feeling is you need a recent freshly patched AD to reproduce 
this, you most probably won't be able to reproduce this with e..g 
OpenLDAP nested groups. So it would be great if someone who knows more 
about AD settings could find the switch to re-enable this.

Cheers

Martin




Am 19.04.26 um 22:09 schrieb Fisher, Daniel via users:
>
> What version of the IDP are you running?
>
> Are you setting followReferrals=“true” directly on the 
> <DataConnector/> configuration?
>
> If you post your (redacted) configuration here I can review it.
>
-- 

*Dr. MARTIN HITSCHEL | System Engineer*

Phone: +49 7071 407109-0
Email: martin.hitschel at daasi.de

*DAASI International GmbH*
Europaplatz 3
D-72072 Tübingen, Germany
www.daasi.de

Registered Office: Tübingen
Registration Court: Amtsgericht Stuttgart, HRB 382175
CEO: Peter Gietz
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20260420/4e755d6a/attachment.htm>