From 5b5cf9f0061ad9349da786f4a56f817595567489 Mon Sep 17 00:00:00 2001 From: David Warden Date: Thu, 17 Mar 2016 13:38:32 -0400 Subject: [PATCH] documentation for ldap nested groups --- conf/ldap.toml | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/conf/ldap.toml b/conf/ldap.toml index aa8a9679d68..5cc374b83da 100644 --- a/conf/ldap.toml +++ b/conf/ldap.toml @@ -28,6 +28,23 @@ search_base_dns = ["dc=grafana,dc=org"] # This is done by enabling group_search_filter below. You must also set member_of= "cn" # in [servers.attributes] below. +# Users with nested/recursive group membership must have an LDAP server that supports LDAP_MATCHING_RULE_IN_CHAIN +# and set group_search_filter below in such a way that it returns the groups the submitted username is a member of. +# +# Nested Groups + Active Directory (AD) Example: +# +# AD groups store the Distinguished Names (DNs) of members, so your filter will need to know the DN +# for the user based only on the submitted username. Multiple DN templates can be +# searched by combining filters with the LDAP or operator. +# +# Some examples: +# group_search_filter = "(member:1.2.840.113556.1.4.1941:=CN=%s,[user container/OU])" +# group_search_filter = "(|(member:1.2.840.113556.1.4.1941:=CN=%s,[user container/OU])(member:1.2.840.113556.1.4.1941:=CN=%s,[another user container/OU]))" +# +# You might also want to change member_of in [servers.attributes] to "distinguishedName". This +# does not appear to be necessary but it will show you more accurate group membership if +# verbose_logging is enabled. + ## Group search filter, to retrieve the groups of which the user is a member (only set if memberOf attribute is not available) # group_search_filter = "(&(objectClass=posixGroup)(memberUid=%s))" ## An array of the base DNs to search through for groups. Typically uses ou=groups