Security

Hi All,

I got a case where I need to extract out the memberOf attribute from Microsoft AD to use it as Authorization rule, but when I query the AD, this object has two memberOf's (shown two rows and every row has different value).

When checked to AD, this object has multiple 'AD group' under the "memberOf" tab, which means it is member of two OU so-called.
I tried to alias these two memberOf into separate rule, but only one shows up.
I don't know how or when this memberOf show as the query return, because for example if one object only has one memberOf or none memberOf, one object to another will have different parameter ID of memberOf, right ? (or how is it exactly, not AD expert)

When the endpoint authenticates, at the Input attribute @ Access Tracker, I can only see one of it.​

So anyone knows how to query the exact memberOf we wanted ?

PS: I am not in charge of the AD, and the customer's AD 99.9% won't change (or we can't change), so we need to find a way.

(Attached some screenshots)

Hi

It's normal that you have multiple memberOf  rows. If a user is a member of 20 groups you will have 20 of them.
In the role mapping or enforcement you should use the condition Contains instead of Equals.
See the attaches screenshot


------------------------------
Best Regards
Jonas Hammarbäck
ACCX #1335, ACMP, ACDP, ACNSP, ACEP
Aranya AB
------------------------------

Original Message:
Sent: Sep 22, 2022 06:43 AM
From: BERNHARD HUSTOMO
Subject: Multiple "memberOf" AD Attributes

Hi All,

I got a case where I need to extract out the memberOf attribute from Microsoft AD to use it as Authorization rule, but when I query the AD, this object has two memberOf's (shown two rows and every row has different value).

When checked to AD, this object has multiple 'AD group' under the "memberOf" tab, which means it is member of two OU so-called.
I tried to alias these two memberOf into separate rule, but only one shows up.
I don't know how or when this memberOf show as the query return, because for example if one object only has one memberOf or none memberOf, one object to another will have different parameter ID of memberOf, right ? (or how is it exactly, not AD expert)

When the endpoint authenticates, at the Input attribute @ Access Tracker, I can only see one of it.​

So anyone knows how to query the exact memberOf we wanted ?

PS: I am not in charge of the AD, and the customer's AD 99.9% won't change (or we can't change), so we need to find a way.

(Attached some screenshots)

Or even better, use AD:Group EQUALS groupname, instead of memberOf CONTAINS in your role mapping or enforcement.

AD:Group EQUALS groupname matches if the user is member of that group.

------------------------------
Herman Robers
------------------------
If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
------------------------------

Original Message:
Sent: Sep 22, 2022 07:03 AM
From: Jonas Hammarback
Subject: Multiple "memberOf" AD Attributes

Hi

It's normal that you have multiple memberOf  rows. If a user is a member of 20 groups you will have 20 of them.
In the role mapping or enforcement you should use the condition Contains instead of Equals.
See the attaches screenshot


------------------------------
Best Regards
Jonas Hammarbäck
ACCX #1335, ACMP, ACDP, ACNSP, ACEP
Aranya AB

Original Message:
Sent: Sep 22, 2022 06:43 AM
From: BERNHARD HUSTOMO
Subject: Multiple "memberOf" AD Attributes

Hi All,

I got a case where I need to extract out the memberOf attribute from Microsoft AD to use it as Authorization rule, but when I query the AD, this object has two memberOf's (shown two rows and every row has different value).

When checked to AD, this object has multiple 'AD group' under the "memberOf" tab, which means it is member of two OU so-called.
I tried to alias these two memberOf into separate rule, but only one shows up.
I don't know how or when this memberOf show as the query return, because for example if one object only has one memberOf or none memberOf, one object to another will have different parameter ID of memberOf, right ? (or how is it exactly, not AD expert)

When the endpoint authenticates, at the Input attribute @ Access Tracker, I can only see one of it.​

So anyone knows how to query the exact memberOf we wanted ?

PS: I am not in charge of the AD, and the customer's AD 99.9% won't change (or we can't change), so we need to find a way.

(Attached some screenshots)

Hi, thanks for the answer it helps me too.
Original Message:
Sent: Sep 22, 2022 07:30 AM
From: Herman Robers
Subject: Multiple "memberOf" AD Attributes

Or even better, use AD:Group EQUALS groupname, instead of memberOf CONTAINS in your role mapping or enforcement.

AD:Group EQUALS groupname matches if the user is member of that group.

------------------------------
Herman Robers
------------------------
If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.

Original Message:
Sent: Sep 22, 2022 07:03 AM
From: Jonas Hammarback
Subject: Multiple "memberOf" AD Attributes

Hi

It's normal that you have multiple memberOf  rows. If a user is a member of 20 groups you will have 20 of them.
In the role mapping or enforcement you should use the condition Contains instead of Equals.
See the attaches screenshot


------------------------------
Best Regards
Jonas Hammarbäck
ACCX #1335, ACMP, ACDP, ACNSP, ACEP
Aranya AB

Original Message:
Sent: Sep 22, 2022 06:43 AM
From: BERNHARD HUSTOMO
Subject: Multiple "memberOf" AD Attributes

Hi All,

I got a case where I need to extract out the memberOf attribute from Microsoft AD to use it as Authorization rule, but when I query the AD, this object has two memberOf's (shown two rows and every row has different value).

When checked to AD, this object has multiple 'AD group' under the "memberOf" tab, which means it is member of two OU so-called.
I tried to alias these two memberOf into separate rule, but only one shows up.
I don't know how or when this memberOf show as the query return, because for example if one object only has one memberOf or none memberOf, one object to another will have different parameter ID of memberOf, right ? (or how is it exactly, not AD expert)

When the endpoint authenticates, at the Input attribute @ Access Tracker, I can only see one of it.​

So anyone knows how to query the exact memberOf we wanted ?

PS: I am not in charge of the AD, and the customer's AD 99.9% won't change (or we can't change), so we need to find a way.

(Attached some screenshots)