How To: Configure Nested Group Restriction on a Realm

Version Affected: All versions

 

Overview

This article explains how to configure a SecureAuth realm that has a group restriction enabled to also check nested Active Directory (AD) group membership, so that users in a nested group are included by the restriction, not just users in the top-level allowed group.

Configure Nested Group Restriction

1. On the realm's Data tab, under Profile Provider Settings, set Same As Above to False and Default Profile Provider to Directory Server.

2. Under Profile Connection Settings, configure the data store connection with the same settings used on your primary realm connection (the one containing user information). Set Advanced AD User Check to True if you want to check for blocked accounts and expired passwords. Make sure Include Nested Groups is checked, and leave Allowed User Groups blank.
3. Under Profile Fields, make sure the Groups property's Field is set to MemberOf.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.