# How to update LDAP config to allow users in group of groups

**URL:** <https://forum.ansible.com/t/how-to-update-ldap-config-to-allow-users-in-group-of-groups/30721>\
**Category:** AWX Project\
**Tags:** awx\
**Created:** [July 8, 2019, 7:13am UTC](https://forum.ansible.com/t/how-to-update-ldap-config-to-allow-users-in-group-of-groups/30721 "2019-07-08T07:13:04Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ankit2](https://avatars.discourse-cdn.com/v4/letter/a/ea5d25/32.png) [@Ankit2](https://forum.ansible.com/u/Ankit2)\
**Post date:** [July 8, 2019, 7:13am UTC](https://forum.ansible.com/t/how-to-update-ldap-config-to-allow-users-in-group-of-groups/30721/1 "2019-07-08T07:13:04Z")

</div>

I have been testing authentication using LDAP, it works fine for me when i provide a group where users are members of that group. I have been reading the documents but unfortunately unable to make the configuration scenario work when i have:

**LDAP Require group:** Top group where all the team groups will be present.

**Top Group (Group-A)**  
**|**  
**|**  
----- **AWX\_ADMINS** - All members are admin of AWX.  
**|**  
**|**  
----- **TeamA\_Group** - All members have limited access which is provided to the team.  
**|**  
**|**  
----- **TeamB\_Group** - All members have limited access which is provided to the team.

My Current configuration works for the top group with all the users are part of that group:

**LDAP Group Type** : MemberDNGroupType  
**LDAP Require Group:** CN=AWX\_ADMINS,OU=Groups,DC=dr,DC=svc,DC=company,DC=com  
**LDAP User Search:**

[  
“OU=People,DC=dr,DC=svc,DC=company,DC=com”,  
“SCOPE\_SUBTREE”,  
“(sAMAccountName=%(user)s)”  
]

**LDAP Group Search:**

[  
“OU=Groups,DC=dr,DC=svc,DC=company,DC=com”,  
“SCOPE\_SUBTREE”,  
“(objectClass=groupOfNames)”  
]

**LDAP Group Type Parameters:**

{  
“name\_attr”: “cn”,  
“member\_attr”: “member”  
}

**LDAP User Flags By Group:**

{  
“is\_superuser”: [  
“CN=AWX\_ADMINS,OU=Groups,DC=dr,DC=svc,DC=company,DC=com”  
]  
}

How can i modify the above config in such a way that i am able to allow the users who are not directly members of the group but are members of the nested group of the **LDAP Require Group.** Any pointers would be really helpful.

---

<div class="post-metadata">

**Author:** ![Ankit2](https://avatars.discourse-cdn.com/v4/letter/a/ea5d25/32.png) [@Ankit2](https://forum.ansible.com/u/Ankit2)\
**Post date:** [July 9, 2019, 6:03am UTC](https://forum.ansible.com/t/how-to-update-ldap-config-to-allow-users-in-group-of-groups/30721/2 "2019-07-09T06:03:55Z")

</div>

Hello All,

Can someone please share few inputs for this, it would be really helpful for us.

---

<div class="post-metadata">

**Author:** ![sdmorel](https://avatars.discourse-cdn.com/v4/letter/s/c2a13f/32.png) [@sdmorel](https://forum.ansible.com/u/sdmorel)\
**Post date:** [July 9, 2019, 8:59am UTC](https://forum.ansible.com/t/how-to-update-ldap-config-to-allow-users-in-group-of-groups/30721/3 "2019-07-09T08:59:20Z")

</div>

Hi,

Have you tried storing one LDAP configuration for each group of users?  
Like, using LDAP server Default, then LDAP 1 and LDAP 2 for each group of users.

It may not be the best solution, but it should fit your needs.

Regards,  
Sergio

---

<div class="post-metadata">

**Author:** ![Ankit2](https://avatars.discourse-cdn.com/v4/letter/a/ea5d25/32.png) [@Ankit2](https://forum.ansible.com/u/Ankit2)\
**Post date:** [July 9, 2019, 11:29am UTC](https://forum.ansible.com/t/how-to-update-ldap-config-to-allow-users-in-group-of-groups/30721/4 "2019-07-09T11:29:49Z")

</div>

Hi Sergio,

Thanks for your response. I had the assumption that we can use just one LDAP configuration profile at one time. I will try this but, i didn’t get how multiple profiles would be helpful in allowing multiple nested groups. Could you please share some more insights, this would be really helpful for me.

Thanks in advance.

---

<div class="post-metadata">

**Author:** ![Stefan\_Jakobs](https://avatars.discourse-cdn.com/v4/letter/s/8baadc/32.png) [@Stefan\_Jakobs](https://forum.ansible.com/u/Stefan_Jakobs)\
**Post date:** [July 9, 2019, 1:12pm UTC](https://forum.ansible.com/t/how-to-update-ldap-config-to-allow-users-in-group-of-groups/30721/5 "2019-07-09T13:12:33Z")

</div>

Hi,

have you tried to use **LDAP Group Type** : **NestedMemberDNGroupType**?

Regards  
Stefan

---

<div class="post-metadata">

**Author:** ![Ankit2](https://avatars.discourse-cdn.com/v4/letter/a/ea5d25/32.png) [@Ankit2](https://forum.ansible.com/u/Ankit2)\
**Post date:** [July 10, 2019, 3:19pm UTC](https://forum.ansible.com/t/how-to-update-ldap-config-to-allow-users-in-group-of-groups/30721/6 "2019-07-10T15:19:50Z")

</div>

We were able to resolve this issue. For the reference of others, the related configurations can be found in the below github issue.  
[https://github.com/ansible/awx/issues/496](https://github.com/ansible/awx/issues/496)

Thanks to everyone who shared their suggestions.