Bug 1385744

Summary:	[RFE] Nested group when retrieving users from AD
Product:	Red Hat Satellite	Reporter:	Waldirio M Pinheiro <wpinheir>
Component:	LDAP	Assignee:	Daniel Lobato Garcia <dlobatog>
Status:	CLOSED WONTFIX	QA Contact:	Katello QA List <katello-qa-list>
Severity:	high	Docs Contact:
Priority:	unspecified
Version:	6.2.0	CC:	calba, dhlavacd, jcallaha, ldelouw, mhulan, nshaik, stran
Target Milestone:	Unspecified	Keywords:	FutureFeature
Target Release:	Unused
Hardware:	x86_64
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2018-11-30 14:49:56 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:

Description Waldirio M Pinheiro 2016-10-17 15:43:31 UTC

Description of problem:
Customer have two groups, the first one is principal and the second one nested, customer would like to define just the first one and Satellite should be able to query and *know* all users members of all nested groups.

Version-Release number of selected component (if applicable):
6.2

How reproducible:
100

Steps to Reproduce:
1. Create two groups
2. Add the second one as nested of first one
3. Create one user inside second group
4. Configure Satellite to authenticate
5. Try to authenticate using the user inside the second group

Actual results:
it's not possible.

Expected results:
Login normally, once Satellite should check nested groups

Additional info:

Comment 5 César Alba 2017-06-15 07:26:18 UTC

I would like the enhancement to work on any LDAP group tree if possible.

Comment 7 Waldirio M Pinheiro 2017-09-05 13:58:43 UTC

Hi all

Just one full description about the workaround.

Soon I'll prepare one kcs about it.

---

Nested groups in Satellite 6.2.x

// On AD side we have

	- domain.example
		- Users
			- normal_grp
			- nested_grp
				- testuser
	
	PS: On this case nested_grp is a group memberof normal_grp


Just some AD/Objects Information

// DN of group used on test
	CN=normal_grp,CN=Users,DC=Domain,DC=example


On Satellite side

// When adding this LDAP filter, we enable all members of normal_grp to login but not nested users
	(&(objectCategory=Person)(sAMAccountName=*)(memberOf:=CN=normal_grp,CN=Users,DC=Domain,DC=example))

// When adding the code *1.2.840.113556.1.4.1941* on the filter, we enable nested users to login
	(&(objectCategory=Person)(sAMAccountName=*)(memberOf:1.2.840.113556.1.4.1941:=CN=normal_grp,CN=Users,DC=Domain,DC=example))


Best Regards
-- 
Waldirio M Pinheiro | Senior Software Maintenance Engineer

Comment 8 Waldirio M Pinheiro 2017-09-05 14:58:35 UTC

Hello all

https://access.redhat.com/solutions/3172711

Best Regards
-- 
Waldirio M Pinheiro | Senior Software Maintenance Engineer

Comment 9 Nagoor Shaik 2017-09-11 09:57:21 UTC

*** Bug 1484016 has been marked as a duplicate of this bug. ***

Comment 10 Bryan Kearney 2018-11-01 14:44:08 UTC

The Satellite Team is attempting to provide an accurate backlog of bugzilla requests which we feel will be resolved in the next few releases. We do not believe this bugzilla will meet that criteria, and have plans to close it out in 1 month. This is  not a reflection on the validity of the request, but a reflection of the many priorities for the product. If you have any concerns about this, feel free to contact Rich Jerrido or Bryan Kearney or your account team. If we do not hear from you, we will close this bug out. Thank you.

Comment 11 Bryan Kearney 2018-11-30 14:49:56 UTC

Thank you for your interest in Satellite 6. We have evaluated this request, and while we recognize that it is a valid request, we do not expect this to be implemented in the product in the foreseeable future. This is due to other priorities for the product, and not a reflection on the request itself. We are therefore closing this out as WONTFIX. If you have any concerns about this, please do not reopen. Instead, feel free to contact Rich Jerrido or Bryan Kearney. Thank you.