Graylog2 / Graylog2/graylog2-server
Allow multiple base DN for LDAP/AD configuration
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
### How is it working currently (include screenshots and steps if needed):
Currently, Graylog’s LDAP/Active Directory integration allows specifying only one Search Base DN in the configuration. This means that user lookups are limited to a single Organizational Unit (OU) or subtree within the directory.
If users are distributed across multiple OUs, administrators must either:
- Move all relevant users into one OU, or Create complex directory structures or synchronization mechanisms outside Graylog.
- This limitation complicates environments with multiple departments or segregated OUs for security and compliance reasons.
Customer also used the following work around but "this makes it very static and a little confusing when you put all the groups into the user query."
Workaround:
LDAP filters to LDAP/AD must query members of groups (CN) rather than members of organization units (OU). So you need to create groups and point users to this groups. Then you can use filter like:
(&(objectClass=user)(sAMAccountName={0})(|(memberof=CN=GraylogAdmins,CN=Users,DC=company,DC=local) (memberof=CN=GraylogReaders,CN=Users,DC=company,DC=local)))
### Intended Purpose:
The purpose of this feature request is to enable Graylog to support multiple Search Base DNs in its LDAP/AD configuration. This would allow administrators to map users from different OUs without restructuring the directory or implementing external workarounds.
### Expected Outcome:
After implementation, Graylog should allow administrators to:
- Define a list of Search Base DNs (e.g., OU=Admins,DC=example,DC=com and OU=Operators,DC=example,DC=com).
- Perform user lookups across all specified DNs during authentication and role mapping.
- Maintain compatibility with existing LDAP/AD settings and security controls.
### Business Impact:
Supporting multiple Search Base DNs would:
- Reduce administrative overhead by eliminating the need for directory restructuring or synchronization scripts.
- Improve security and compliance by allowing organizations to maintain their OU-based segregation policies.
- Enhance user experience by ensuring all relevant users can authenticate and be mapped correctly without manual intervention.
- Increase adoption of Graylog in enterprise environments with complex directory structures.
Taken from Graylog2/support#367
Contributor guide
Assessment
This issue has not been assessed yet.