Active Directory Recursive Search Option
This feature changes the default search behavior for user group memberships on Windows Active Directory (AD) LDAP servers. By default, nested groups (groups that are members or other groups) are not searched, as this can slow down the group membership search. A new option is added to enable searching nested groups for user group memberships on AD LDAP servers. This option is not available for other LDAP servers, such as OpenLDAP based LDAP servers.
The default behavior does not include nested groups:
config user ldap edit "ldap-ad" set server "10.1.100.131" set cnid "cn" set dn "dc=fortinet-fsso,dc=com" set type regular set username "cn=Administrator,cn=users,dc=fortinet-fsso,dc=com" set password XXXXXXXXXXXXXXXXXXXXXXXX next end
The default search results show only groups that have the user as member, and no groups that have groups as members:
diagnose test authserver ldap ldap-ad nuser nuser authenticate 'nuser' against 'ldap-ad' succeeded! Group membership(s) - CN=nested3,OU=Testing,DC=Fortinet-FSSO,DC=COM CN=Domain Users,CN=Users,DC=Fortinet-FSSO,DC=COM
Enable recursive search to include nested groups in the results:
config user ldap edit "ldap-ad" set server "10.1.100.131" set cnid "cn" set dn "dc=fortinet-fsso,dc=com" set type regular set username "cn=Administrator,cn=users,dc=fortinet-fsso,dc=com" set password XXXXXXXXXXXXXXXXXXXXXXXX set search-type recursive next end
The search results include groups that have other groups as members:
diagnose test authserver ldap ldap-ad nuser nuser authenticate 'nuser' against 'ldap-ad' succeeded! Group membership(s) - CN=nested3,OU=Testing,DC=Fortinet-FSSO,DC=COM CN=Domain Users,CN=Users,DC=Fortinet-FSSO,DC=COM CN=nested2,OU=Testing,DC=Fortinet-FSSO,DC=COM CN=nested1,OU=Testing,DC=Fortinet-FSSO,DC=COM
The group nested3 is a member of the group nested2, which is itself a member of the group nested1.