Support for AD nested groups #1436

andham · 2015-09-21T09:52:07Z

It would be great if Graylog could support so-called nested groups in AD.
The easiest way to do this would be to have the group member attribute configurable. You can then use a special object ID as described in https://msdn.microsoft.com/en-us/library/windows/desktop/aa746475(v=vs.85).aspx.

Some information on how this is handled in some other tool (Nexus): https://support.sonatype.com/entries/31005457-How-to-Configure-Nexus-to-use-Active-Directory-Nested-Groups

alpar-t · 2015-09-28T15:21:28Z

Also looking for this. With the current implementation src/main/java/org/graylog2/security/ldap/LdapConnector.java needs to do a query for each group to see if those are a member of some other group (member:1.2.840.113556.1.4.1941:=CN=)

matthgyver · 2016-02-09T13:47:16Z

"member:1.2.840.113556.1.4.1941:=CN=" is good for authentication but it would be great if group mapping support nested groups

nixcorn · 2016-03-30T07:58:47Z

👍
For us it's a show stopper, we rely on nested groups from Active Directory because if a new one joins the company, it's easy to add him to a few groups and there are the direct permission groups for all the applications. Would be awesome if it's possible to add this to Graylog 2.0 :)

arnefm · 2016-09-14T20:13:26Z

Yup, this is a big issue for our setup too. We separate our group into access groups which have one-to-one relationships with specific permissions and services and role groups, which contain users and are members of different access groups.

In fact I'm surprised this issue hasn't gotten more attention! It's been open for a year.

jhaar · 2016-11-28T03:47:23Z

Ditto. We've just started getting complaints of people not having the correct access and ended up tracking it back to a nested groups issue

simonpie · 2017-05-01T19:32:24Z

We are also in dire need for this functionality.

CoolDuke · 2017-05-17T09:03:02Z

+1 for this feature since we have to use our organizational groups instead of the permission groups defined in Active Directory, so we have change the permissions twice if anything is to be changed.

Dainii · 2017-11-08T10:01:02Z

Hi, is there any news about this feature ?

Wicht78 · 2017-12-15T11:07:36Z

We would really need this.
Hope it is comming soon :)

shakalandy · 2018-03-05T14:49:20Z

@jalogisch is it possible to "donate" this feature? Via BountySource or similar?

joschi · 2018-03-13T12:19:42Z

@shakalandy Please contact our sales team at https://graylog.org/contact-sales or via sales@graylog.com for finding out how this aligns with our general business strategy.

samoz83 · 2018-06-28T19:03:48Z

Any news on this feature? I assume it's not being considered for the v3 release?

ivazqueza · 2018-09-10T13:13:52Z

I'm also very interested on this. It would be a very useful feature.

lukaszpatyra · 2018-09-24T19:16:43Z

+1

matthiasdoering · 2018-10-19T13:58:05Z

+1

nhanct · 2018-11-06T11:15:30Z

+1

exussum12 · 2018-11-19T14:59:42Z

Not sure if this helps but the query needed here is (member:1.2.840.113556.1.4.1941:={distinguishedname})

Where {distinguishedname} is the dn of the user being looked up.

It looks like

graylog2-server/graylog2-server/src/main/java/org/graylog2/security/ldap/LdapConnector.java

Line 200 in 20ab732

ldapEntry.addGroups(findGroups(connection,

is a good place to start. I'm not 100% sure how to get the stack working currently to test this fix though

OmniTroid · 2019-01-03T09:40:54Z

This has been open for three years.. are you planning to implement this at all? I'd love to see this feature as well.

pirona · 2019-04-01T09:45:40Z

Is this related to the fact that I cannot map any groups from this cn=groups,dc=subdomain,dc=domain,dc=tld ? (nothing show up in LDAP group mapping)

jalogisch · 2019-04-01T09:49:32Z

@pirona likely not - or did you have groups in groups in that?

pirona · 2019-04-01T09:51:10Z

@pirona likely not - or did you have groups in groups in that?

No, no sublevels in this folder. Sorry for the topic mismatch then.

mungo312 · 2019-10-24T09:26:25Z

Hi,
any updates on this ? It is a common usage pattern in the Active Directory context to use nested groups.

xtruthx · 2020-02-05T09:57:05Z

It seems that this issue is not longer exist? Actually we tested it with nested groups from a Active Directory and it seems to work fine without any occurrence of error messages in the log. Also the relation for the groups have been set accordingly.

Workaround/Solution

Use a major group where the other groups are nested in your Active Directory. Then use a "User Search Pattern" with memberOf-Function.

Steps to Reproduce

Create major group
Set group inheritage for the inherit groups
Use following User Query for Example:
(&(objectCategory=person)(objectClass=user)(sAMAccountName={0})(memberof:1.2.840.113556.1.4.1941:=cn=major_group,cn=Users,ou=Group-Unit,ou=nextunit,ou=anotherunit,dc=ex,dc=sample,dc=com)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))

Tested Environment

Graylog Version: 3.1.4+1149fe1, codename Quantum Dog
Elasticsearch Version: 6.8.6
MongoDB Version: v4.3.0-707-g284630e-patch-5d3f10cc850e612543561a3a
Operating System:
NAME="Red Hat Enterprise Linux"
VERSION="8.1 (Ootpa)"
ID="rhel"
ID_LIKE="fedora"
VERSION_ID="8.1"
PLATFORM_ID="platform:el8"
PRETTY_NAME="Red Hat Enterprise Linux 8.1 (Ootpa)"
Browser version: Firefox Quantum 68.4.1esr (64-Bit)

@bernd @jalogisch could this be the solution or workaround for that issue? Can you may please add some explanation from the code perspective to this?

A possible Attribute Option in the product would be still good and could still be a valid feature request. At least it would make things easier for some people.

rsirny · 2020-03-19T13:16:22Z

@xtruthx I've tried what you suggest with following setup on Graylog 3.2.2, but it does not seem to work. Do you see anything I could have missed?

My AD structure:
Graylog_Major_Group (DN used in the user query)

Graylog_Admin
- Graylog_AdminNested

For user in Graylog_Admin group, the login works as expected. Logging in with user from Graylog_AdminNested fails with error:

2020-03-19 12:39:25,113 ERROR: org.graylog2.security.realm.LdapUserAuthenticator - Error during LDAP user account sync. Cannot log in user testuser,
java.lang.RuntimeException: ERR_02002_FAILURE_ON_UNDERLYING_CURSOR Failure on underlying Cursor.,
	at org.apache.directory.api.ldap.model.cursor.CursorIterator.next(CursorIterator.java:89) ~[graylog.jar:?],
	at org.graylog2.security.ldap.LdapConnector.search(LdapConnector.java:142) ~[graylog.jar:?],
	at org.graylog2.security.realm.LdapUserAuthenticator.searchLdapUser(LdapUserAuthenticator.java:160) ~[graylog.jar:?],
	at org.graylog2.security.realm.LdapUserAuthenticator.doGetAuthenticationInfo(LdapUserAuthenticator.java:110) [graylog.jar:?],
	at org.apache.shiro.realm.AuthenticatingRealm.getAuthenticationInfo(AuthenticatingRealm.java:571) [graylog.jar:?],
	at org.apache.shiro.authc.pam.ModularRealmAuthenticator.doMultiRealmAuthentication(ModularRealmAuthenticator.java:219) [graylog.jar:?],
	at org.apache.shiro.authc.pam.ModularRealmAuthenticator.doAuthenticate(ModularRealmAuthenticator.java:269) [graylog.jar:?],
	at org.apache.shiro.authc.AbstractAuthenticator.authenticate(AbstractAuthenticator.java:198) [graylog.jar:?],
	at org.apache.shiro.mgt.AuthenticatingSecurityManager.authenticate(AuthenticatingSecurityManager.java:106) [graylog.jar:?],
	at org.apache.shiro.mgt.DefaultSecurityManager.login(DefaultSecurityManager.java:274) [graylog.jar:?],
	at org.apache.shiro.subject.support.DelegatingSubject.login(DelegatingSubject.java:260) [graylog.jar:?],
	at org.graylog2.shared.security.SessionCreator.create(SessionCreator.java:77) [graylog.jar:?],
	at org.graylog2.rest.resources.system.SessionsResource.newSession(SessionsResource.java:129) [graylog.jar:?],
	at sun.reflect.GeneratedMethodAccessor1060.invoke(Unknown Source) ~[?:?],
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:1.8.0_242],
	at java.lang.reflect.Method.invoke(Method.java:498) ~[?:1.8.0_242],
	at org.glassfish.jersey.server.model.internal.ResourceMethodInvocationHandlerFactory$1.invoke(ResourceMethodInvocationHandlerFactory.java:81) [graylog.jar:?],
	at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher$1.run(AbstractJavaResourceMethodDispatcher.java:144) [graylog.jar:?],
	at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.invoke(AbstractJavaResourceMethodDispatcher.java:161) [graylog.jar:?],
	at org.glassfish.jersey.server.model.internal.JavaResourceMethodDispatcherProvider$TypeOutInvoker.doDispatch(JavaResourceMethodDispatcherProvider.java:205) [graylog.jar:?],
	at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.dispatch(AbstractJavaResourceMethodDispatcher.java:99) [graylog.jar:?],
	at org.glassfish.jersey.server.model.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:389) [graylog.jar:?],
	at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:347) [graylog.jar:?],
	at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:102) [graylog.jar:?],
	at org.glassfish.jersey.server.ServerRuntime$2.run(ServerRuntime.java:326) [graylog.jar:?],
	at org.glassfish.jersey.internal.Errors$1.call(Errors.java:271) [graylog.jar:?],
	at org.glassfish.jersey.internal.Errors$1.call(Errors.java:267) [graylog.jar:?],
	at org.glassfish.jersey.internal.Errors.process(Errors.java:315) [graylog.jar:?],
	at org.glassfish.jersey.internal.Errors.process(Errors.java:297) [graylog.jar:?],
	at org.glassfish.jersey.internal.Errors.process(Errors.java:267) [graylog.jar:?],
	at org.glassfish.jersey.process.internal.RequestScope.runInScope(RequestScope.java:317) [graylog.jar:?],
	at org.glassfish.jersey.server.ServerRuntime.process(ServerRuntime.java:305) [graylog.jar:?],
	at org.glassfish.jersey.server.ApplicationHandler.handle(ApplicationHandler.java:1154) [graylog.jar:?],
	at org.glassfish.jersey.grizzly2.httpserver.GrizzlyHttpContainer.service(GrizzlyHttpContainer.java:384) [graylog.jar:?],
	at org.glassfish.grizzly.http.server.HttpHandler$1.run(HttpHandler.java:224) [graylog.jar:?],
	at com.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:181) [graylog.jar:?],
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_242],
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_242],
	at java.lang.Thread.run(Thread.java:748) [?:1.8.0_242],
Caused by: org.apache.directory.api.ldap.model.cursor.CursorLdapReferralException,
	at org.apache.directory.ldap.client.api.EntryCursorImpl.get(EntryCursorImpl.java:174) ~[graylog.jar:?],
	at org.apache.directory.ldap.client.api.EntryCursorImpl.get(EntryCursorImpl.java:52) ~[graylog.jar:?],
	at org.apache.directory.api.ldap.model.cursor.CursorIterator.next(CursorIterator.java:82) ~[graylog.jar:?],�
	... 38 more,

xtruthx · 2020-04-21T08:09:04Z

@xtruthx I've tried what you suggest with following setup on Graylog 3.2.2, but it does not seem to work. Do you see anything I could have missed?

My AD structure:
Graylog_Major_Group (DN used in the user query)

* Graylog_Admin
  
  * Graylog_AdminNested

For user in Graylog_Admin group, the login works as expected. Logging in with user from Graylog_AdminNested fails with error:

2020-03-19 12:39:25,113 ERROR: org.graylog2.security.realm.LdapUserAuthenticator - Error during LDAP user account sync. Cannot log in user testuser,
java.lang.RuntimeException: ERR_02002_FAILURE_ON_UNDERLYING_CURSOR Failure on underlying Cursor.,
	at org.apache.directory.api.ldap.model.cursor.CursorIterator.next(CursorIterator.java:89) ~[graylog.jar:?],
	at org.graylog2.security.ldap.LdapConnector.search(LdapConnector.java:142) ~[graylog.jar:?],
	at org.graylog2.security.realm.LdapUserAuthenticator.searchLdapUser(LdapUserAuthenticator.java:160) ~[graylog.jar:?],
	at org.graylog2.security.realm.LdapUserAuthenticator.doGetAuthenticationInfo(LdapUserAuthenticator.java:110) [graylog.jar:?],
	at org.apache.shiro.realm.AuthenticatingRealm.getAuthenticationInfo(AuthenticatingRealm.java:571) [graylog.jar:?],
	at org.apache.shiro.authc.pam.ModularRealmAuthenticator.doMultiRealmAuthentication(ModularRealmAuthenticator.java:219) [graylog.jar:?],
	at org.apache.shiro.authc.pam.ModularRealmAuthenticator.doAuthenticate(ModularRealmAuthenticator.java:269) [graylog.jar:?],
	at org.apache.shiro.authc.AbstractAuthenticator.authenticate(AbstractAuthenticator.java:198) [graylog.jar:?],
	at org.apache.shiro.mgt.AuthenticatingSecurityManager.authenticate(AuthenticatingSecurityManager.java:106) [graylog.jar:?],
	at org.apache.shiro.mgt.DefaultSecurityManager.login(DefaultSecurityManager.java:274) [graylog.jar:?],
	at org.apache.shiro.subject.support.DelegatingSubject.login(DelegatingSubject.java:260) [graylog.jar:?],
	at org.graylog2.shared.security.SessionCreator.create(SessionCreator.java:77) [graylog.jar:?],
	at org.graylog2.rest.resources.system.SessionsResource.newSession(SessionsResource.java:129) [graylog.jar:?],
	at sun.reflect.GeneratedMethodAccessor1060.invoke(Unknown Source) ~[?:?],
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:1.8.0_242],
	at java.lang.reflect.Method.invoke(Method.java:498) ~[?:1.8.0_242],
	at org.glassfish.jersey.server.model.internal.ResourceMethodInvocationHandlerFactory$1.invoke(ResourceMethodInvocationHandlerFactory.java:81) [graylog.jar:?],
	at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher$1.run(AbstractJavaResourceMethodDispatcher.java:144) [graylog.jar:?],
	at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.invoke(AbstractJavaResourceMethodDispatcher.java:161) [graylog.jar:?],
	at org.glassfish.jersey.server.model.internal.JavaResourceMethodDispatcherProvider$TypeOutInvoker.doDispatch(JavaResourceMethodDispatcherProvider.java:205) [graylog.jar:?],
	at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.dispatch(AbstractJavaResourceMethodDispatcher.java:99) [graylog.jar:?],
	at org.glassfish.jersey.server.model.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:389) [graylog.jar:?],
	at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:347) [graylog.jar:?],
	at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:102) [graylog.jar:?],
	at org.glassfish.jersey.server.ServerRuntime$2.run(ServerRuntime.java:326) [graylog.jar:?],
	at org.glassfish.jersey.internal.Errors$1.call(Errors.java:271) [graylog.jar:?],
	at org.glassfish.jersey.internal.Errors$1.call(Errors.java:267) [graylog.jar:?],
	at org.glassfish.jersey.internal.Errors.process(Errors.java:315) [graylog.jar:?],
	at org.glassfish.jersey.internal.Errors.process(Errors.java:297) [graylog.jar:?],
	at org.glassfish.jersey.internal.Errors.process(Errors.java:267) [graylog.jar:?],
	at org.glassfish.jersey.process.internal.RequestScope.runInScope(RequestScope.java:317) [graylog.jar:?],
	at org.glassfish.jersey.server.ServerRuntime.process(ServerRuntime.java:305) [graylog.jar:?],
	at org.glassfish.jersey.server.ApplicationHandler.handle(ApplicationHandler.java:1154) [graylog.jar:?],
	at org.glassfish.jersey.grizzly2.httpserver.GrizzlyHttpContainer.service(GrizzlyHttpContainer.java:384) [graylog.jar:?],
	at org.glassfish.grizzly.http.server.HttpHandler$1.run(HttpHandler.java:224) [graylog.jar:?],
	at com.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:181) [graylog.jar:?],
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_242],
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_242],
	at java.lang.Thread.run(Thread.java:748) [?:1.8.0_242],
Caused by: org.apache.directory.api.ldap.model.cursor.CursorLdapReferralException,
	at org.apache.directory.ldap.client.api.EntryCursorImpl.get(EntryCursorImpl.java:174) ~[graylog.jar:?],
	at org.apache.directory.ldap.client.api.EntryCursorImpl.get(EntryCursorImpl.java:52) ~[graylog.jar:?],
	at org.apache.directory.api.ldap.model.cursor.CursorIterator.next(CursorIterator.java:82) ~[graylog.jar:?],�
	... 38 more,

Without your settings in Graylog in special without your search queries i can not give you a valid answer.

mungo312 · 2020-08-11T08:43:16Z

For us the actual problem is not to limit the users to the members of one group. We need to use the group mapping feature to map members of nested groups to roles in graylog. The before mentioned LDAP filter is no help at all for our usage scenario.
The Issue is open since 2015 and there was no real effort invested from the Graylog Team, as far as I can see. Is this a supported feature in enterprise edition ? Can we speed up the process by getting enterprise and then open an issue ?

ppodevlabs · 2020-10-07T14:55:29Z

For us the actual problem is not to limit the users to the members of one group. We need to use the group mapping feature to map members of nested groups to roles in graylog. The before mentioned LDAP filter is no help at all for our usage scenario.
The Issue is open since 2015 and there was no real effort invested from the Graylog Team, as far as I can see. Is this a supported feature in enterprise edition ? Can we speed up the process by getting enterprise and then open an issue ?

I managed to make it work actually.

i've created the following structure:

graylog-base
- level1-group
  -level2-group

With this setup and using filters:

Users:
(&(objectCategory=person)(objectClass=user)(sAMAccountName={0})(memberof:1.2.840.113556.1.4.1941:=cn=graylog-base,ou=your_ou,dc=your_dc,DC=blabla)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))

Groups:
(&(objectClass=group)(memberof:1.2.840.113556.1.4.1941:=cn=graylog-base,ou=your_ou,dc=your_dc,DC=blabla)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))

Results:
User in level1-group can login
user in level2-group can login
Both groups are mapped into graylog

Hope that helps!

bernd · 2020-12-01T18:43:41Z

Nested group support is now part of Graylog Enterprise 4.0.

See the following links for more details:

Announcement: https://www.graylog.org/post/announcing-graylog-v4-0
Upgrade notes: https://docs.graylog.org/en/4.0/pages/upgrade/graylog-4.0.html
Background information regarding group changes: Keep AD group mapping in GL 4 OS #9392 (comment)

andham mentioned this issue Sep 21, 2015

Allow forcing "group object class" / "memberAttribute" for LDAP auth #1433

Closed

bernd added ldap feature labels Oct 14, 2015

edmundoa mentioned this issue Feb 23, 2016

ldap nested group support missing graylog-labs/graylog2-web-interface#1712

Closed

jalogisch added the triaged label Jan 12, 2017

jalogisch mentioned this issue Feb 25, 2018

LDAP Authentication - Cannot search group of groups #4374

Open

This was referenced Oct 15, 2018

graylog gets confused when LDAP contains groups with groupOfNames and posixGroup #5199

Closed

AD Nested Groups #5204

Closed

bernd closed this as completed Dec 1, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Support for AD nested groups #1436

Support for AD nested groups #1436

andham commented Sep 21, 2015

alpar-t commented Sep 28, 2015

matthgyver commented Feb 9, 2016

nixcorn commented Mar 30, 2016

arnefm commented Sep 14, 2016 •

edited

jhaar commented Nov 28, 2016

simonpie commented May 1, 2017

CoolDuke commented May 17, 2017

Dainii commented Nov 8, 2017

Wicht78 commented Dec 15, 2017

shakalandy commented Mar 5, 2018

joschi commented Mar 13, 2018

samoz83 commented Jun 28, 2018

ivazqueza commented Sep 10, 2018

lukaszpatyra commented Sep 24, 2018

matthiasdoering commented Oct 19, 2018

nhanct commented Nov 6, 2018

exussum12 commented Nov 19, 2018 •

edited

OmniTroid commented Jan 3, 2019

pirona commented Apr 1, 2019

jalogisch commented Apr 1, 2019

pirona commented Apr 1, 2019 •

edited

mungo312 commented Oct 24, 2019

xtruthx commented Feb 5, 2020

rsirny commented Mar 19, 2020

xtruthx commented Apr 21, 2020

mungo312 commented Aug 11, 2020

ppodevlabs commented Oct 7, 2020 •

edited

bernd commented Dec 1, 2020

Support for AD nested groups #1436

Support for AD nested groups #1436

Comments

andham commented Sep 21, 2015

alpar-t commented Sep 28, 2015

matthgyver commented Feb 9, 2016

nixcorn commented Mar 30, 2016

arnefm commented Sep 14, 2016 • edited

jhaar commented Nov 28, 2016

simonpie commented May 1, 2017

CoolDuke commented May 17, 2017

Dainii commented Nov 8, 2017

Wicht78 commented Dec 15, 2017

shakalandy commented Mar 5, 2018

joschi commented Mar 13, 2018

samoz83 commented Jun 28, 2018

ivazqueza commented Sep 10, 2018

lukaszpatyra commented Sep 24, 2018

matthiasdoering commented Oct 19, 2018

nhanct commented Nov 6, 2018

exussum12 commented Nov 19, 2018 • edited

OmniTroid commented Jan 3, 2019

pirona commented Apr 1, 2019

jalogisch commented Apr 1, 2019

pirona commented Apr 1, 2019 • edited

mungo312 commented Oct 24, 2019

xtruthx commented Feb 5, 2020

Workaround/Solution

Steps to Reproduce

Tested Environment

rsirny commented Mar 19, 2020

xtruthx commented Apr 21, 2020

mungo312 commented Aug 11, 2020

ppodevlabs commented Oct 7, 2020 • edited

bernd commented Dec 1, 2020

arnefm commented Sep 14, 2016 •

edited

exussum12 commented Nov 19, 2018 •

edited

pirona commented Apr 1, 2019 •

edited

ppodevlabs commented Oct 7, 2020 •

edited