Security

Reply
Frequent Contributor II
Posts: 110
Registered: ‎12-07-2007

AD group type

[ Edited ]

Short version: Does the AD group type (universal, global or domain local) have any bearing on role derivation in CPPM?  User is in a global group "elementary" which is then part of domain local group "Employees".  I keep getting failures to authenticate because CPPM does not indicate the user is in "Employees" but AD clearly shows that it is there.  The user in question does show up in the groups he is directly added to but not the nested group (in CPPM details).  SubTree Search is turned on for the AD authentication source.

 

I've done this before at a previous job but I had no access to AD at that location.  I suspect it doesn't matter but I could be wrong.

Guru Elite
Posts: 8,447
Registered: ‎09-08-2010

Re: AD group type

Are you using "Groups" or "memberOf" in your authorization?

Tim Cappalli | Aruba Security TME
@timcappalli | timcappalli.me | ACMX #367 / ACCX #480
Frequent Contributor II
Posts: 110
Registered: ‎12-07-2007

Re: AD group type

memberof  CONTAINS

 

Learned that the hardway previously.

Guru Elite
Posts: 8,447
Registered: ‎09-08-2010

Re: AD group type

Can you try using Group instead? memberOf sometimes has issues with nested
groups.



You should be able to see the contents of Group in access tracker under
authorization.

Tim Cappalli | Aruba Security TME
@timcappalli | timcappalli.me | ACMX #367 / ACCX #480
Frequent Contributor II
Posts: 110
Registered: ‎12-07-2007

Re: AD group type

I tried "groups CONTAINS"

 

This was added to the "Input" -> "Authorization Attributes" when I used groups but still not seeing "Employees" show up.

  

Authorization:Active Directory:Groups:   Elementary, Elementary Teachers   

Aruba
Posts: 1,542
Registered: ‎06-12-2012

Re: AD group type

Remember when you are testing you must clear the cache if you make a change on the AD side. we only auth live each time but AD groups and etc are only pulled on the cache intervals.
Thank You,
Troy

--Give Kudos: found something helpful, important, or cool? Click Kudos Star in a post.

--Problem Solved? Click "Accepted Solution" in a post.
Frequent Contributor II
Posts: 110
Registered: ‎12-07-2007

Re: AD group type

Still not showing up in CPPM.  I'll work on getting upgraded to the latest CPPM release and see if it corrects the issue.

Occasional Contributor II
Posts: 12
Registered: ‎11-14-2008

Re: AD group type

Did this ever get resolved?  I am seeing similar issues and have tried configuring for nested groups in several ways, but with no success.

 

Search Airheads
Showing results for 
Search instead for 
Did you mean: