<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Hi Daniel,</p>
<p>I see this with several customers, most of them run 5.2.x, some
5.1.6.</p>
<p>My documentation states this should spit out memberOfs for nested
groups, at least that used to work before:</p>
<p>
<span style="font-family:monospace"><span
style="color:#000000;background-color:#ffffff;">
<DataConnector id="myLDAP" xsi:type="LDAPDirectory"</span><span
style="color:#000000;background-color:#ffffff;">
</span><br>
<span style="color:#000000;background-color:#ffffff;">
ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"</span><span
style="color:#000000;background-color:#ffffff;">
</span><br>
<span style="color:#000000;background-color:#ffffff;">
baseDN="%{idp.attribute.resolver.LDAP.baseDN}"</span><span
style="color:#000000;background-color:#ffffff;">
</span><br>
<span style="color:#000000;background-color:#ffffff;">
principal="%{idp.attribute.resolver.LDAP.bindDN}"</span><span
style="color:#000000;background-color:#ffffff;">
</span><br>
<span style="color:#000000;background-color:#ffffff;">
principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}"</span><span
style="color:#000000;background-color:#ffffff;">
</span><br>
<span style="color:#000000;background-color:#ffffff;">
useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS:true}"</span><span
style="color:#000000;background-color:#ffffff;">
</span><br>
<span style="color:#000000;background-color:#ffffff;">
connectTimeout="%{idp.attribute.resolver.LDAP.connectTimeout}"</span><span
style="color:#000000;background-color:#ffffff;">
</span><br>
<span style="color:#000000;background-color:#ffffff;">
trustFile="%{idp.attribute.resolver.LDAP.trustCertificates}"</span><br>
<span style="color:#000000;background-color:#ffffff;"> <b>followReferrals="true"</b>
exportAttributes="mail givenName sn cn <b>memberOf</b>"</span><span
style="color:#000000;background-color:#ffffff;">
</span><br>
<span style="color:#000000;background-color:#ffffff;">
responseTimeout="%{idp.attribute.resolver.LDAP.responseTimeout}"></span><span
style="color:#000000;background-color:#ffffff;">
</span><br>
<span style="color:#000000;background-color:#ffffff;">
<FilterTemplate></span><span
style="color:#000000;background-color:#ffffff;">
</span><br>
<span style="color:#000000;background-color:#ffffff;">
<![CDATA[</span><span
style="color:#000000;background-color:#ffffff;">
</span><br>
<span style="color:#000000;background-color:#ffffff;">
%{idp.attribute.resolver.LDAP.searchFilter}</span><span
style="color:#000000;background-color:#ffffff;">
</span><br>
<span style="color:#000000;background-color:#ffffff;">
]]></span><span
style="color:#000000;background-color:#ffffff;">
</span><br>
<span style="color:#000000;background-color:#ffffff;">
</FilterTemplate></span><span
style="color:#000000;background-color:#ffffff;">
</span><br>
<span style="color:#000000;background-color:#ffffff;">
</DataConnector></span><br>
<span style="color:#000000;background-color:#ffffff;">
</span><br>
</span>with
<span style="font-family:monospace"><span
style="color:#000000;background-color:#ffffff;">idp.attribute.resolver.LDAP.searchFilter
= (sAMAccountName=$resolutionContext.principal)</span><br>
<span style="color:#000000;background-color:#ffffff;"></span></span></p>
<p>At least with an extra connector we should be getting the nested
groups:</p>
<p>
<span style="font-family:monospace"><span
style="color:#000000;background-color:#ffffff;">
<DataConnector id="myLDAPGroups"
xsi:type="LDAPDirectory"</span><span
style="color:#000000;background-color:#ffffff;">
</span><br>
<span style="color:#000000;background-color:#ffffff;">
ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"</span><span
style="color:#000000;background-color:#ffffff;">
</span><br>
<span style="color:#000000;background-color:#ffffff;">
baseDN="%{idp.attribute.resolver.LDAP.baseDN}"</span><span
style="color:#000000;background-color:#ffffff;">
</span><br>
<span style="color:#000000;background-color:#ffffff;">
principal="%{idp.attribute.resolver.LDAP.bindDN}"</span><span
style="color:#000000;background-color:#ffffff;">
</span><br>
<span style="color:#000000;background-color:#ffffff;">
principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}"</span><span
style="color:#000000;background-color:#ffffff;">
</span><br>
<span style="color:#000000;background-color:#ffffff;">
useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS:true}"</span><span
style="color:#000000;background-color:#ffffff;">
</span><br>
<span style="color:#000000;background-color:#ffffff;">
connectTimeout="%{idp.attribute.resolver.LDAP.connectTimeout}"</span><span
style="color:#000000;background-color:#ffffff;">
</span><br>
<span style="color:#000000;background-color:#ffffff;">
responseTimeout="%{idp.attribute.resolver.LDAP.responseTimeout}"</span><span
style="color:#000000;background-color:#ffffff;">
</span><br>
<span style="color:#000000;background-color:#ffffff;"> <b>followReferrals="true"</b>
trustFile="%{idp.attribute.resolver.LDAP.trustCertificates}"</span><span
style="color:#000000;background-color:#ffffff;">
</span><br>
<span style="color:#000000;background-color:#ffffff;">
maxResultSize="0"></span><span
style="color:#000000;background-color:#ffffff;">
</span><br>
<span style="color:#000000;background-color:#ffffff;">
<InputDataConnector ref="myLDAP"
attributeNames="distinguishedName"/></span><span
style="color:#000000;background-color:#ffffff;">
</span><br>
<span style="color:#000000;background-color:#ffffff;">
<FilterTemplate></span><span
style="color:#000000;background-color:#ffffff;">
</span><br>
<span style="color:#000000;background-color:#ffffff;">
<![CDATA[</span><span
style="color:#000000;background-color:#ffffff;">
</span><br>
<span style="color:#000000;background-color:#ffffff;">
<b>(member:1.2.840.113556.1.4.1941:=$distinguishedName.get(0))</b></span><span
style="color:#000000;background-color:#ffffff;">
</span><br>
<span style="color:#000000;background-color:#ffffff;">
]]></span><span
style="color:#000000;background-color:#ffffff;">
</span><br>
<span style="color:#000000;background-color:#ffffff;">
</FilterTemplate></span><span
style="color:#000000;background-color:#ffffff;">
</span><br>
<span style="color:#000000;background-color:#ffffff;">
<ReturnAttributes></span><span
style="color:#000000;background-color:#ffffff;">
</span><br>
<span style="color:#000000;background-color:#ffffff;">
distinguishedName</span><span
style="color:#000000;background-color:#ffffff;">
</span><br>
<span style="color:#000000;background-color:#ffffff;">
</ReturnAttributes></span><span
style="color:#000000;background-color:#ffffff;">
</span><br>
<span style="color:#000000;background-color:#ffffff;">
</DataConnector></span></span></p>
<p><span style="font-family:monospace">with </span></p>
<p>
<span style="font-family:monospace"><span
style="color:#000000;background-color:#ffffff;">
<AttributeDefinition id="</span></span>memberOf<span
style="font-family:monospace"><span
style="color:#000000;background-color:#ffffff;">"
xsi:type="Simple"></span><span
style="color:#000000;background-color:#ffffff;">
</span><br>
<span style="color:#000000;background-color:#ffffff;">
<InputDataConnector ref="myLDAPGroups"
attributeNames="distinguishedName"/></span><span
style="color:#000000;background-color:#ffffff;">
</span><br>
<span style="color:#000000;background-color:#ffffff;">
</AttributeDefinition></span><br>
</span><br>
</p>
<p>This started failing maybe a year ago or so throughout most AD
customers. So I believe there came a new AD default setting along.
I remember on customer working with us and experimenting with
their AD settings, but the best we could get were timeouts, even
up to 30 seconds without result.</p>
<p>My gut feeling is you need a recent freshly patched AD to
reproduce this, you most probably won't be able to reproduce this
with e..g OpenLDAP nested groups. So it would be great if someone
who knows more about AD settings could find the switch to
re-enable this.</p>
<p>Cheers</p>
<p>Martin</p>
<p><br>
</p>
<p><br>
</p>
<p><br>
</p>
<div class="moz-cite-prefix">Am 19.04.26 um 22:09 schrieb Fisher,
Daniel via users:<br>
</div>
<blockquote type="cite"
cite="mid:PH7PR05MB92498CA9153BC7D7F8F60CB8C52E2@PH7PR05MB9249.namprd05.prod.outlook.com">
<p class="ms-outlook-mobile-reference-message skipProofing"><span
style="font-size: 16px; color: rgb(0, 0, 0);">What version of
the IDP are you running?</span></p>
<p class="ms-outlook-mobile-reference-message skipProofing"><span
style="font-size: 16px; color: rgb(0, 0, 0);">Are you setting
followReferrals=</span>“<span
style="font-size: 16px; color: rgb(0, 0, 0);">true</span><span
style="font-size: 16px;">”</span><span
style="font-size: 16px; color: rgb(0, 0, 0);"> directly on the
<DataConnector/> configuration? </span></p>
<p class="ms-outlook-mobile-reference-message skipProofing"><span
style="font-size: 16px; color: rgb(0, 0, 0);">If you post your
(redacted) configuration here I can review it.</span></p>
</blockquote>
<div class="moz-signature">-- <br>
<p><strong>Dr. MARTIN HITSCHEL | System Engineer</strong></p>
<p>Phone: +49 7071 407109-0<br>
Email: <a>martin.hitschel@daasi.de</a></p>
<p><strong>DAASI International GmbH</strong><br>
Europaplatz 3<br>
D-72072 Tübingen, Germany<br>
<a class="moz-txt-link-abbreviated" href="http://www.daasi.de">www.daasi.de</a></p>
<p>Registered Office: Tübingen<br>
Registration Court: Amtsgericht Stuttgart, HRB 382175<br>
CEO: Peter Gietz</p>
</div>
</body>
</html>