jperezduerto.info
Security in depth · Unit 24 · Lesson 8 of 14
Nested groups change effective access
Follow a supported membership chain all the way to the resource permission it grants.
Helpful before thisActive Directory
After this lesson you can
- Explain an indirect read grant using group scope, nested membership, and the resource ACL.
A harmless-sounding group can sit at the beginning of a sensitive permission chain.
Membership has a path
Active Directory security groups can contain other groups where their scopes permit it. Global, universal, and domain-local scopes have different membership and permission rules. Group names alone do not describe those rules or the authority granted.
A common design places accounts in a global role group and that group in a domain-local resource group. The resource ACL names the latter. Reviewing only a user’s direct groups would miss the rest of that chain.
Supplied record: the town archive
The fictional archive approves Mila to read public exhibition notes, but not its internal acquisition records.
Domain: all listed accounts, groups, and the resource belong to the same domain.
Mila: member of Helpers, a global security group.
Helpers: member of Archive-Readers, a domain-local security group.
Acquisition-record ACL: Archive-Readers may read.
Assume the current authorization context correctly includes this supported nesting. The path is reachable, and no deny, restriction, or additional policy changes the read result. Mila therefore receives the acquisition-record read grant indirectly, beyond the approved purpose.
Review the relationship, not the label
The record establishes unexpected authority, not evidence that Mila opened a record. Ask the archive owner to review why Helpers was nested there and which legitimate users depend on the relationship.
Your written map should show Mila, both groups, and the resource permission. A correction needs to preserve approved archive readers while excluding Helpers members who only need public notes. Recheck the resulting authorization after the approved change; editing membership is not itself proof that every existing session has refreshed.
Check yourself
No timer. No penalties. Read the explanation and try again whenever you like.
This lesson’s questions have changed. Your reading progress is saved; review the updated questions.
-
Mila is not directly listed in Archive-Readers, but Helpers is nested inside it. What follows under the supplied assumptions?
Show the answer
Correct answer: She receives the archive read grant through the supported nested membership chain. Her membership in Helpers leads to Archive-Readers, which the resource ACL permits. Direct membership in the final group is not required here.
Try it
- WriteDraw the three relationships from Mila to the archive, then write which owner should review the unexpected nesting. Include the intended allowed and denied reads after an approved correction.