Graylog2 / Graylog2/graylog2-server

LDAP Authentication - Cannot search group of groups

Open
#4,374 2 comments 0 reactions 0 assignees View on GitHub
feature ldap triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

## Scenario

In this scenario there are 2x groups:
"cn=graylog_users"
"cn=dev_team"

Members of graylog_users = "cn=dev_team" (nested group)
Members of dev_team = "cn=John Doe"

**Graylog is configured to search for group "cn=graylog_users"**

If I configure graylog to search for "cn=dev_team" it works fine but that's the not the group I want to search for.

## Expected Behavior
Successful user and group search

## Current Behavior
The connection test passes but it cannot find the group membership....

_"LDAP server did not return any groups for the user."_ is what's returned from connection test.

I have tried both groupOfNames and groupOfUniqueNames - both give the same result.

**I have to add the _user_ explicitly to the group in order for Graylog to find the group membership properly.** No matter what I try I cannot get it to handle a group within a group.

## Possible Solution
WORKAROUND: Explicitly add the user to graylog_users group - **this works perfectly.** However this is not ideal since I'll need to add the users to both groups.

The goal is to have "graylog_users" group be comprised of several groups (devs/sysadmins/managers/risk/etc)

I have this "nested group" configuration working fine with other LDAP clients (such as jenkins) and it's finding the group membership just fine. Seems specific to the way graylog interacts with LDAP.

* Graylog Version: v2.3.2

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.