Graylog2 / Graylog2/graylog2-server

Allow multiple base DN for LDAP/AD configuration

Open
#24,238 0 comments 0 reactions 0 assignees View on GitHub
7.2 Candidate feature triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

### How is it working currently (include screenshots and steps if needed):

Currently, Graylog’s LDAP/Active Directory integration allows specifying only one Search Base DN in the configuration. This means that user lookups are limited to a single Organizational Unit (OU) or subtree within the directory.

If users are distributed across multiple OUs, administrators must either:

- Move all relevant users into one OU, or Create complex directory structures or synchronization mechanisms outside Graylog.

- This limitation complicates environments with multiple departments or segregated OUs for security and compliance reasons.

Customer also used the following work around but "this makes it very static and a little confusing when you put all the groups into the user query."

Workaround:
LDAP filters to LDAP/AD must query members of groups (CN) rather than members of organization units (OU). So you need to create groups and point users to this groups. Then you can use filter like:

(&(objectClass=user)(sAMAccountName={0})(|(memberof=CN=GraylogAdmins,CN=Users,DC=company,DC=local) (memberof=CN=GraylogReaders,CN=Users,DC=company,DC=local)))

### Intended Purpose:

The purpose of this feature request is to enable Graylog to support multiple Search Base DNs in its LDAP/AD configuration. This would allow administrators to map users from different OUs without restructuring the directory or implementing external workarounds.

### Expected Outcome:

After implementation, Graylog should allow administrators to:

- Define a list of Search Base DNs (e.g., OU=Admins,DC=example,DC=com and OU=Operators,DC=example,DC=com).
- Perform user lookups across all specified DNs during authentication and role mapping.
- Maintain compatibility with existing LDAP/AD settings and security controls.



### Business Impact:

Supporting multiple Search Base DNs would:

- Reduce administrative overhead by eliminating the need for directory restructuring or synchronization scripts.
- Improve security and compliance by allowing organizations to maintain their OU-based segregation policies.
- Enhance user experience by ensuring all relevant users can authenticate and be mapped correctly without manual intervention.
- Increase adoption of Graylog in enterprise environments with complex directory structures.

Taken from Graylog2/support#367

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.