Allow AD auto-provisioning to expand all sub domain groups

[laurencee]

Given the following domain group setup in AD:

DG-Parent
- Person A
- DG-AChild
  - Person B
  - Person C
- DG-BChild
  - Person D
  - Person E

Auto provisioning set to DG-Parent should auto provision accounts for person A/B/C/D/E

This should be able to recurse any depth level of domain groups but also detect circular references and break out appropriately.

[nblumhardt]

Thanks @laurencee 👍

[Sebbl22]

We would like to see this feature, since my organisation uses a heavily nested Active Directory group structure.

See also: https://docs.datalust.co/discuss/5cff73f0423f50005da372ac

[c0shea]

I'd also like to see this capability added. We also use nested groups heavily. Essentially we want to be able to add our existing groups that represent departments of users to the auto-provisioning group and have it work.

[nblumhardt]

We've had patchy success with the System.DirectoryServices APIs in the past, so I think this will ideally use the Windows ADDS APIs for the purpose. See e.g. https://docs.microsoft.com/en-us/windows/win32/ad/example-code-for-checking-for-membership-in-a-group

Making this change would also hopefully broaden the range of environments in which this feature can be successfully used.

[HaGGi13]

Hello,

because I'm still faced with this issue (missing auto provision support for users in nested AD groups) it seems not to be implemented yet, right?

Is there any chance to get this feature implemented in one of the next versions?

Many thanks for any feedback.

[nblumhardt]

Hi Christopher, thanks for your message.

No, unfortunately - there's been a lot more activity around OpenID Connect these past few years and so most of our authentication-related efforts have been going there. I don't suppose you're in an environment where using an OIDC provider is an option?

[HaGGi13]

Hi Nicholas, thank you for your reply.

I'm very sorry, I didn't got any notification regards you answer or I missed it.
Unfortunately, no OIDC support in our environment yet.
Okay, so, no chance for any support of nested AD groups in next time.

[nblumhardt]

Thanks for your reply @HaGGi13 ; it's good feedback to have, we'll certainly keep this in mind.

Best regards,
Nick