From bc339a4c10edf540f1dd9129f1b79266d8dbf1dd Mon Sep 17 00:00:00 2001 From: Jorge Pereira Date: Thu, 23 Jul 2020 12:34:19 -0300 Subject: [PATCH] ldap: Add references for Active Directory 'Nested groups' (#3532) --- raddb/mods-available/ldap | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/raddb/mods-available/ldap b/raddb/mods-available/ldap index 1741d7e6ed4..36af3862285 100644 --- a/raddb/mods-available/ldap +++ b/raddb/mods-available/ldap @@ -198,6 +198,19 @@ ldap { # filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" + # For Active Directory nested group, you should comment out the previous 'filter = ...' + # and use the below. Where 'group' is the group you are querying for. + # + # NOTE: The string '1.2.840.113556.1.4.1941' specifies LDAP_MATCHING_RULE_IN_CHAIN. + # This applies only to DN attributes. This is an extended match operator that walks + # the chain of ancestry in objects all the way to the root until it finds a match. + # This reveals group nesting. It is available only on domain controllers with + # Windows Server 2003 SP2 or Windows Server 2008 (or above). + # + # See: https://social.technet.microsoft.com/wiki/contents/articles/5392.active-directory-ldap-syntax-filters.aspx + # +# filter = "(&(objectClass=user)(sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})(memberOf:1.2.840.113556.1.4.1941:=cn=group,${..base_dn}))" + # SASL parameters to use for user binds # # When we're prompted by the SASL library, these control -- 2.47.3