Uploaded image for project: 'Apache NiFi'
  1. Apache NiFi
  2. NIFI-8035

Handle nested LDAP groups in LdapUserGroupProvider

Attach filesAttach ScreenshotAdd voteVotersWatch issueWatchersCreate sub-taskLinkCloneUpdate Comment AuthorReplace String in CommentUpdate Comment VisibilityDelete Comments
    XMLWordPrintableJSON

    Details

    • Type: Improvement
    • Status: Open
    • Priority: Major
    • Resolution: Unresolved
    • Affects Version/s: 1.12.1
    • Fix Version/s: None
    • Component/s: Security

      Description

      Nested LDAP groups are widely used in big organizations especially with Active Directory. Microsoft's AGDLP recommendations rely on nested groups.

      Currently, the LdapUserGroupProvider retrieves users and groups separately. Group memberships are inferred using 'Group Member Attribute' or 'User Group Name Attribute'. It is also possible to construct users and groups relying only on the groups and users entries respectively, this is done in case only one of the "User Search Base" or "Group Search Base" is specified. 

      Microsoft AD (and others such asRed Hat/389 DS) provides support for nested groups retrieval using special filters such as the LDAP_MATCHING_RULE_IN_CHAIN filter_._ With the current implementation, it is not possible to use this filter since it relies on the user's DN being part of the LDAP search filter which would require querying the LDAP server per user. 

      Handling LDAP nested groups would provide much flexibility to organization using Nifi and it would allow compliance with the AGDLP recommandations which is not currently possible. 

        Attachments

          Activity

            People

            • Assignee:
              Unassigned
              Reporter:
              cef111 Moncef ABBOUD

              Dates

              • Created:
                Updated:

                Time Tracking

                Estimated:
                Original Estimate - Not Specified
                Not Specified
                Remaining:
                Remaining Estimate - 0h
                0h
                Logged:
                Time Spent - 0.5h
                0.5h

                  Issue deployment