Nested groups with autosync

[ingox]

When using LDAP CloudStack has the functionality of nested groups once this is set: ldap.nested.groups.enable=true

That means the group which has been added die CloudStack can have sub groups where the users are.

This work with the methods "manualimport". It does not with "autosync"and "autoimport". The result is a failed login.

Does someone experienced the same issue and might have a workaround or solution?

[nickaccuweb]

@ingox

CloudStack supports nested LDAP groups when ldap.nested.groups.enable=true, so ideally this should also work with auto-import and auto-sync.

Since manual import works in your case, I would suggest checking a few things:

1. Verify that ldap.search.group.principle points to the correct parent group and that the nested users are returned correctly.
2. For auto-import, check that the CloudStack domain is correctly linked to the LDAP group.
3. For auto-sync, verify that the CloudStack account is linked to the correct LDAP group and that the user's group membership is being recognized.
4. Check /var/log/cloudstack/management/management-server.log during a failed login. It may help identify whether the problem is related to group membership or account mapping.

There is also a similar issue reported on GitHub regarding nested LDAP groups:

#10278

Official documentation:

https://docs.cloudstack.apache.org/en/4.22.1.0/adminguide/accounts.html#using-an-ldap-server-for-user-authentication

Could you share your CloudStack version, whether you are using Microsoft AD or OpenLDAP, and any relevant errors from the management server logs?

This would help narrow down whether it is a configuration issue or a problem with nested group handling.

Nick R
AccuWeb.Cloud

[ingox]

Thank you @nickaccuweb for the feedback.

I did some further testing. It turned out that the sub group wasn't a proper member of the actual main group. So it was an issue on LDAP side and not in CloudStack.