Technical Tip: Active Directory Recursive Search Option

[Sindre-FTNT]

Description
This article explains this new feature that changes the default search behavior for user group memberships on Windows Active Directory (AD) LDAP servers.
By default, nested groups (groups that are members or other groups) are not searched, as this can slow down the group membership search.

A new option is added to enable searching nested groups for user group memberships on AD LDAP servers.
This option is not available for other LDAP servers, such as OpenLDAP based LDAP servers.

Solution
The default behavior does not include nested groups:

#config user ldap
    edit "ldap-ad"
        set server "10.1.100.131"
        set cnid "cn"
        set dn "dc=fortinet-fsso,dc=com"
        set type regular
        set username "cn=Administrator,cn=users,dc=fortinet-fsso,dc=com"
        set password XXXXXXXXXXXXXXXXXXXXXXXX              
    next
end

The default search results show only groups that have the user as member, and no groups that have groups as members:

#diagnose test authserver ldap ldap-ad nuser nuser
    authenticate 'nuser' against 'ldap-ad' succeeded!
    Group membership(s) - CN=nested3,OU=Testing,DC=Fortinet-FSSO,DC=COM
                          CN=Domain Users,CN=Users,DC=Fortinet-FSSO,DC=COM

Enable recursive search to include nested groups in the results:

#config user ldap
    edit "ldap-ad"
        set server "10.1.100.131"
        set cnid "cn"
        set dn "dc=fortinet-fsso,dc=com"
        set type regular
        set username "cn=Administrator,cn=users,dc=fortinet-fsso,dc=com"
        set password XXXXXXXXXXXXXXXXXXXXXXXX
        set search-type recursive
    next
end

The search results include groups that have other groups as members:

#diagnose test authserver ldap ldap-ad nuser nuser
    authenticate 'nuser' against 'ldap-ad' succeeded!
    Group membership(s) - CN=nested3,OU=Testing,DC=Fortinet-FSSO,DC=COM
                          CN=Domain Users,CN=Users,DC=Fortinet-FSSO,DC=COM
                          CN=nested2,OU=Testing,DC=Fortinet-FSSO,DC=COM
                          CN=nested1,OU=Testing,DC=Fortinet-FSSO,DC=COM

The group nested3 is a member of the group nested2, which is itself a member of the group nested1.