Is it possible to get group hierarchy in AD? It's for managing permissions to a web app from there.

I need to do this:

  • Users
    • Product
      • Admin
        • Task
          • Subtask1
          • Subtask2
          • Subtask3
        • Task 2

So if you are member of Admin you get reference to Task and Task 2 and its children. I think that AD doesn't come with an RBAC hierarchy but I want to be sure.

closed as not constructive by joeqwerty, Ward, mdpc, Dave M, gharper Apr 10 '13 at 21:46

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance. If this question can be reworded to fit the rules in the help center, please edit the question.

  • I think you're asking if Active Directory supports nested groups; It does. Is there something specific you're trying to do? – jscott Apr 8 '13 at 12:45
  • Hi, yes, I need to be member of Task and with a Query, know its childs. If I am member of Task, I should be member of Subtasks1,2,3. Thanks – JorgeeFG Apr 8 '13 at 12:47
  • 1
    Yes, in that configuration, you would be a member (but not a direct member) of all the subtask groups. It's up to the application talking to AD to do its group lookups using recursion (or not). – jscott Apr 8 '13 at 12:49
  • Could you give me a link, an example or something to lead me in the right direction? Thanks – JorgeeFG Apr 8 '13 at 12:51
  • Here's an example of getting nested groups - serverfault.com/questions/429981/… - If you need a specific example, just edit your question and I'll try to help. – jscott Apr 8 '13 at 12:51

Assuming your app supports recursive lookups, or if youre doing this with simple filesystem permissions, yes, that is possible.

What you need to do is to make each parent a member of its direct children. For example, Admin would be a member of Task and Task 2, Task would be a member of Subtask1, Subtask2, and Subtask3. You would then add users to a single group and they would have all the privilege of the subgroups.

Not the answer you're looking for? Browse other questions tagged or ask your own question.