ldap: Add references for Active Directory 'Nested groups' (#3532)

diff --git a/raddb/mods-available/ldap b/raddb/mods-available/ldap
index 1741d7e6ed472617f190f90a545272be980a6ff1..36af38622858ba73c40ae4018d76dc784b8a31f9 100644 (file)
--- a/raddb/mods-available/ldap
+++ b/raddb/mods-available/ldap
@@ -198,6 +198,19 @@ ldap {
                #
                filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})"
 
+               #  For Active Directory nested group, you should comment out the previous 'filter = ...'
+               #  and use the below. Where 'group' is the group you are querying for.
+               #
+               #  NOTE: The string '1.2.840.113556.1.4.1941' specifies LDAP_MATCHING_RULE_IN_CHAIN.
+               #  This applies only to DN attributes. This is an extended match operator that walks
+               #  the chain of ancestry in objects all the way to the root until it finds a match.
+               #  This reveals group nesting. It is available only on domain controllers with
+               #  Windows Server 2003 SP2 or Windows Server 2008 (or above).
+               #
+               #  See: https://social.technet.microsoft.com/wiki/contents/articles/5392.active-directory-ldap-syntax-filters.aspx
+               #
+#              filter = "(&(objectClass=user)(sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})(memberOf:1.2.840.113556.1.4.1941:=cn=group,${..base_dn}))"
+
                #  SASL parameters to use for user binds
                #
                #  When we're prompted by the SASL library, these control