Using of nested groups in ldap

MarcusCaepio · November 9, 2017, 10:28am

Hi all,
When I have an Active Directory group defined in the ACL and in this group I add several other groups, because I don’t want to add 300 people (which are already in this groups) manually, the matching does not work.
How can I fix this?

E.g:
groups: [“group1”]
and group1 consists of

-user1
-user2
-groupwith300people

user 1 and 2 have access, the group has not.

sscarduzio · November 9, 2017, 3:08pm

@MarcusCaepio not sure it will help but have you seen this?

github.com/sscarduzio/elasticsearch-readonlyrest-plugin

(LDAP) Allow for fetching groups from a multi-value attribute on the user

sscarduzio:master ← croemmich:ldap-user-groups

opened 09:06AM - 18 Oct 17 UTC

croemmich

+214 -51

This allows the LDAP authorization connector to fetch groups from the memberOf o…r other multi-value attribute from the user rather than doing the lookup on a group. This is especially helpful when using recursive groups. Two new configuration options have been added: `groups_from_user` a boolean used to toggle between fetching from the group or from an attribute on the user. Default: `false` (fetch from group, current functionality) `groups_from_user_attribute` a string used to indicate which property to check on the user. Default: `memberOf` The `UnboundidGroupsProviderLdapClientTests` class has been largely refactored to include the new functionality and ensure parity. Additionally a check for empty results has been added.

MarcusCaepio · November 10, 2017, 5:27am

Hi Simone,
again thanks a lot! That’s exactly what we need.
Just installed 1.16.13, was on 1.16.11 installed and testing it right now.

Edit: What I can see so far, it works! Awesome!!!

Where can I find a total “What’s new” overview of all releases? I just can find one for the latest version.

sscarduzio · November 10, 2017, 8:29pm

Very happy this is a solution for you! And once again, I thank mr. Chris Roemmich for his excellent work.

Unfortunately, as of today, the most accurate change log is the commit stream, I try to put together a friendlier changelog summary, but it might be not the highest thing in the priority list. Apologies for that.

I will keep in mind that this is something I have to work on, on the workflow level. Whenever something change, I need to update some wiki or something.