AD nested groups

[Fisher, Daniel]

Can you confirm whether the AD instances you’re working with support the LDAP_MATCHING_RULE_IN_CHAIN matching rule?
Unfortunately, I don’t believe there is any way to ask via the LDAP protocol and know which matching rules are supported.
Maybe your AD administrators can answer that question.

If you change your logging configuration to put org.ldaptive in DEBUG you can confirm what AD is responding with for these queries.
That might give some clues.

—Daniel Fisher


From: users <users-bounces at shibboleth.net> on behalf of Martin Hitschel via users <users at shibboleth.net>
Date: Monday, April 20, 2026 at 2:29 AM
To: Fisher, Daniel via users <users at shibboleth.net>
Cc: Martin Hitschel <martin.hitschel at daasi.de>
Subject: Re: AD nested groups


Hi Daniel,

I see this with several customers, most of them run 5.2.x, some 5.1.6.

My documentation states this should spit out memberOfs for nested groups, at least that used to work before:

   <DataConnector id="myLDAP" xsi:type="LDAPDirectory"
       ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"
       baseDN="%{idp.attribute.resolver.LDAP.baseDN}"
       principal="%{idp.attribute.resolver.LDAP.bindDN}"
       principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}"
       useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS:true}"
       connectTimeout="%{idp.attribute.resolver.LDAP.connectTimeout}"
       trustFile="%{idp.attribute.resolver.LDAP.trustCertificates}"
       followReferrals="true" exportAttributes="mail givenName sn cn memberOf"
       responseTimeout="%{idp.attribute.resolver.LDAP.responseTimeout}">
       <FilterTemplate>
           <![CDATA[
               %{idp.attribute.resolver.LDAP.searchFilter}
           ]]>
       </FilterTemplate>
   </DataConnector>

with   idp.attribute.resolver.LDAP.searchFilter        = (sAMAccountName=$resolutionContext.principal)

At least with an extra connector we should be getting the nested groups:

   <DataConnector id="myLDAPGroups" xsi:type="LDAPDirectory"
       ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"
       baseDN="%{idp.attribute.resolver.LDAP.baseDN}"
       principal="%{idp.attribute.resolver.LDAP.bindDN}"
       principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}"
       useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS:true}"
       connectTimeout="%{idp.attribute.resolver.LDAP.connectTimeout}"
       responseTimeout="%{idp.attribute.resolver.LDAP.responseTimeout}"
       followReferrals="true" trustFile="%{idp.attribute.resolver.LDAP.trustCertificates}"
       maxResultSize="0">
     <InputDataConnector ref="myLDAP" attributeNames="distinguishedName"/>
     <FilterTemplate>
       <![CDATA[
                (member:1.2.840.113556.1.4.1941:=$distinguishedName.get(0))
       ]]>
     </FilterTemplate>
     <ReturnAttributes>
       distinguishedName
     </ReturnAttributes>
   </DataConnector>

with

   <AttributeDefinition id="memberOf" xsi:type="Simple">
       <InputDataConnector ref="myLDAPGroups" attributeNames="distinguishedName"/>
   </AttributeDefinition>


This started failing maybe a year ago or so throughout most AD customers. So I believe there came a new AD default setting along. I remember on customer working with us and experimenting with their AD settings, but the best we could get were timeouts, even up to 30 seconds without result.

My gut feeling is you need a recent freshly patched AD to reproduce this, you most probably won't be able to reproduce this with e..g OpenLDAP nested groups. So it would be great if someone who knows more about AD settings could find the switch to re-enable this.

Cheers

Martin




Am 19.04.26 um 22:09 schrieb Fisher, Daniel via users:

What version of the IDP are you running?

Are you setting followReferrals=“true” directly on the <DataConnector/> configuration?

If you post your (redacted) configuration here I can review it.

--

Dr. MARTIN HITSCHEL | System Engineer

Phone: +49 7071 407109-0
Email: martin.hitschel at daasi.de

DAASI International GmbH
Europaplatz 3
D-72072 Tübingen, Germany
www.daasi.de<http://www.daasi.de/>

Registered Office: Tübingen
Registration Court: Amtsgericht Stuttgart, HRB 382175
CEO: Peter Gietz
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20260421/7a542dac/attachment.htm>