How To: Restrict Realm Login by Active Directory Group Using a Search Filter

Version Affected: All

 

Overview

An admin can restrict which Active Directory (AD) groups are allowed to log in to a realm — without using Adaptive Authentication — by customizing the search filter on the Data tab of that realm.

Search Filter Examples

Users who are members of many AD groups can take longer to log in, since SecureAuth has to enumerate all of their group memberships. Narrowing the search filter on the Data tab to only the groups a realm actually needs can speed this up. The default filters are:

The default samAccountName search:

• (&(samAccountName=%v)(objectclass=user))

The default userPrincipalName search:

• (&(userPrincipalName=%v)((objectclass=user)(objectcategory=person)))

To search by username, e-mail, or userPrincipalName (UPN):

• (&(objectclass=user)(|(samaccountname=%v)(mail=%v)(userprincipalname=%v)))

To search for members of a nested group:

• (&(samAccountName=%v)(objectclass=user)(memberOf:1.2.840.113556.1.4.1941:=CN=VPN Groups,OU=Groups,DC=dom,DC=ext))

To search for a member of a specific group:

• (&(samAccountName=%v)(objectclass=user)(memberOf:=CN=VPN Groups,OU=Groups,DC=dom,DC=ext))

To search for a member of a group whose name starts with a few characters:

• (&(samAccountName=%v)(objectclass=user)(memberOf:=CN=VPN\2A,OU=Groups,DC=dom,DC=ext))

Special Considerations

These filters have only been tested using Active Directory as the Membership Connection Setting. Other LDAP directory servers may require a different filter structure.


 

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.