How should inheritance of permissions on AD behave?

Question

Hi Forum members, I am not an AD expert in fact far from it. We have an in house software and we have used Active Directory to authenticate NT accounts to login to our application. In our application we can configure/setup AD groups in such a way that those
group members can get access to specific features and servers in our application. Please see my situation described below:-
I have the following config in place in my application:
LondonGroup (a user group, as present in AD) can manage HR Module of server LondonServer.
BirminghamGroup (as present in AD) can manage Finance Module of server BirminghamServer.
So when a user of AD group LondonGroup logs in to our application, he/she can manage the HR module on LondonServer. Similarly when an user of BirminghamGroup logs in, he/she can manage Finance module on BirminghamServer. That's all fine. The issue arises
when someone in AD makes BirminghamGroup a sub group of LondonGroup i.e. BirminghamGroup is a member of LondonGroup. When this is setup, when a user of AD group LondonGroup logs in to our application, he/she can manage the HR module on LondonServer -
which is still fine BUT when a user of BirminghamGroup logs in he/she can now access HR and Finance modules of both LondonServer and BirminghamServer!! This could be because we support inheritance feature of AD where a sub group should get all access permissions
from its parent group. But is this a problem? for e.g in our application we never set up BirminghamGroup to get access to HR module on LondonServer! 
so my question is:
1) Is this expected behaviour from AD point of view? Is this because the Group setup on the AD is wrong (but there is nothing stopping users to do this)
2) Our application looks for the configured Groups and then traverses down the tree to locate the user and on the way additively gives access rights - is this a wrong implementation?
Sorry for the long story but any guidance will be highly appreciated.

Answer 1

1) Is this expected behaviour from AD point of view? Is this because the Group setup on the AD is wrong (but there is nothing stopping users to do this)
2) Our application looks for the configured Groups and then traverses down the tree to locate the user and on the way additively gives access rights - is this a wrong implementation?
Yes This is by design. There is nothing wrong in it. As Pierre mentioned it is called 'Group Nesting'.
I believe your application is following the concepts of 'Group Nesting' which is fine. It is behaving properly.
If you would like to not to have these sort of traversing in your application, you need to isolate the user accounts of being member in 'Nested Groups'.
Mahdi Tehrani   |  
  |  
www.mahditehrani.ir
Please click on Propose As Answer or to mark this post as
and helpful for other people.
This posting is provided AS-IS with no warranties, and confers no rights.
How to query members of 'Local Administrators' group in all computers?