Mapping AD users in BOE XI 3.0

Question

Hi,
I have a requirement where i need to add the AD group in the following format.
1) Basically Group A has two sub groups -> B and C
where Group A should be local and sub groups B & C Global.
--> Group X has two sub groups -> Y and Z
where Group X should be local and sub groups Y & Z Global.
Group A->local->Sub group( B,C)->global
Group X->local->Sub group(y,z)->global
2) When mapping the Group X should be under Group A in CMC.
Is this scenario possible.Please advise.
Thanks

Answer 1

Ok it's a bit complicated how this works
In the AD plugin you can map groups A, X even the sub groups if you like, but in our plugin you cannot make AD groups members of other AD groups, in fact you cannot make anything a member of any AD group.
AD group membership is decided by the plugin, when you map a group the CMS will query AD for members, if any of the members is another group, then the CMS will query that sub group for members also. The situation you described is called nested groups which is supported.
I think the best practice when using nested groups is to either...
A) Map in the parent and member groups, then you will have all the groups available in the CMC to assign permissions, just note that the members of any of the nested groups will also be members of the parents (just like in AD) so they will inherit permissions from both groups
B) You can also map in the parent group and let the plugin bring in all the members. At this point you can make the members a member of Enterprise groups or assign all permissions to the parent group. If bringing in a lot of users this is not a desirable situation, but for small groups should be fine.
Another option is to ask your AD admins to create specific BO groups so everything lines up with your BO security model, sometimes they can even delegate this right to the BO Admin as well if it's allowed.
It's doubtful that this behavior will be changed, the AD plugin has worked this way for quite some time and most of our customers use it like the scenarios above.
Regards,
Tim