# Question Regarding Role-Based Access Control with Nested Groups in Active Directory **URL:** \ **Category:** Feature Requests\ **Created:** [May 29, 2025, 11:20am UTC](https://forum.search-guard.com/t/question-regarding-role-based-access-control-with-nested-groups-in-active-directory/4588 "2025-05-29T11:20:28Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Daisy](https://avatars.discourse-cdn.com/v4/letter/d/a6a055/32.png) [@Daisy](https://forum.search-guard.com/u/Daisy)\ **Post date:** [May 29, 2025, 11:20am UTC](https://forum.search-guard.com/t/question-regarding-role-based-access-control-with-nested-groups-in-active-directory/4588/1 "2025-05-29T11:20:28Z")
Hi everyone, I’m currently setting up Search Guard for a small cluster (3-node Elasticsearch 8.11.1) and integrating it with our corporate Active Directory for authentication and authorization. So far, basic LDAP integration is working well—I can authenticate users and assign static roles via the sg\_roles\_mapping.yml file. However, we’re trying to scale this by leveraging nested groups within Active Directory to manage permissions more cleanly. The idea is to avoid listing every user individually in the mapping file and instead assign roles based on group membership (e.g., “SG\_READ\_ONLY” role tied to the “Analytics\_ReadOnly” group, which itself contains other AD groups as members). My question is: does Search Guard support nested group resolution out-of-the-box, or do I need to configure something specific in the authc or authz modules to make this work reliably? > [@\[search-guard group\] How to integrate Search Guard with external authentication backend?](https://forum.search-guard.com/t/search-guard-group-how-to-integrate-search-guard-with-external-authentication-backend/201): > > Implement com.floragunn.searchguard.auth.AuthenticationBackend Example: [search-guard-authbackend-ldap/src/main/java/com/floragunn/dlic/auth/ldap/backend/LDAPAuthenticationBackend.java at master · floragunncom/search-guard-authbackend-ldap · GitHub](https://github.com/floragunncom/search-guard-authbackend-ldap/blob/master/src/main/java/com/floragunn/dlic/auth/ldap/backend/LDAPAuthenticationBackend.java) or [https://github.com/floragunncom/search-guard/blob/master/src/main/java/com/floragunn/searchguard/auth/internal/InternalAuthenticationBackend.java](https://github.com/floragunncom/search-guard/blob/master/src/main/java/com/floragunn/searchguard/auth/internal/InternalAuthenticationBackend.java) Then in sg\_config.yml you can use it in the following way:       basic\_myown\_auth\_domain:         e… Some details: - Using ldap authc and ldap authz backend. - Nested groups are used extensively in our AD structure. - I have group\_search defined in sg\_config, and I’ve tried setting resolve\_nested\_groups: true (but not sure if it applies in this context). - Search Guard version is 53.6.0, if that matters. If there’s a preferred way to debug group resolution (e.g., logs, curl queries to verify what groups are being picked up), that would also be helpful. Thanks in advance! ---
**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/pablo/32/1443_2.png) [@pablo](https://forum.search-guard.com/u/pablo)\ **Post date:** [May 30, 2025, 10:06am UTC](https://forum.search-guard.com/t/question-regarding-role-based-access-control-with-nested-groups-in-active-directory/4588/2 "2025-05-30T10:06:58Z")
Hi @Daisy. Just to clarify, you are running 8.11.1 with Search Guard plugin 53.6.0? As per Search Guard documentation this is unsupported version. [https://docs.search-guard.com/latest/search-guard-versions](https://docs.search-guard.com/latest/search-guard-versions) The closest supported version to yours is 8.11.4 with Search Guard FLX 2.0.0 ---
**Author:** ![system](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/system/32/1870_2.png) [@system](https://forum.search-guard.com/u/system)\ **Post date:** [June 20, 2025, 10:07am UTC](https://forum.search-guard.com/t/question-regarding-role-based-access-control-with-nested-groups-in-active-directory/4588/3 "2025-06-20T10:07:02Z")
This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.