[filebeat][entityanalytics] - Fix AD Entity Analytics failing to fetch users when Base DN contains a group CN (#48395)

entityAnalytics: Fix AD Entity Analytics not returning users when Base DN contains group (CN)

Groups are leaf objects in LDAP - users are members of groups, not children.
When Base DN includes a group CN (e.g., CN=Admin Users,OU=Groups,DC=...),
the search now validates the CN against LDAP and uses a memberOf filter
instead of subtree search. Containers like CN=Users continue to work normally.

(cherry picked from commit cdc7276)

Author: ShourieG

changelog/fragments/1768282953-entityanalytics-bugfix.yaml

@@ -0,0 +1,45 @@
+# REQUIRED
+# Kind can be one of:
+# - breaking-change: a change to previously-documented behavior
+# - deprecation: functionality that is being removed in a later release
+# - bug-fix: fixes a problem in a previous version
+# - enhancement: extends functionality but does not break or fix existing behavior
+# - feature: new functionality
+# - known-issue: problems that we are aware of in a given version
+# - security: impacts on the security of a product or a user’s deployment.
+# - upgrade: important information for someone upgrading from a prior version
+# - other: does not fit into any of the other categories
+kind: bug-fix
+
+# REQUIRED for all kinds
+# Change summary; a 80ish characters long description of the change.
+summary:  Fix AD Entity Analytics failing to fetch users when Base DN contains a group CN
+
+# REQUIRED for breaking-change, deprecation, known-issue
+# Long description; in case the summary is not enough to describe the change
+# this field accommodate a description without length limits.
+# description:
+
+# REQUIRED for breaking-change, deprecation, known-issue
+# impact:
+
+# REQUIRED for breaking-change, deprecation, known-issue
+# action:
+
+# REQUIRED for all kinds
+# Affected component; usually one of "elastic-agent", "fleet-server", "filebeat", "metricbeat", "auditbeat", "all", etc.
+component: filebeat
+
+# AUTOMATED
+# OPTIONAL to manually add other PR URLs
+# PR URL: A link the PR that added the changeset.
+# If not present is automatically filled by the tooling finding the PR where this changelog fragment has been added.
+# NOTE: the tooling supports backports, so it's able to fill the original PR number instead of the backport PR number.
+# Please provide it if you are adding a fragment for a different PR.
+pr: https://github.com/elastic/beats/pull/48395
+
+# AUTOMATED
+# OPTIONAL to manually add other issue URLs
+# Issue URL; optional; the GitHub issue related to this changeset (either closes or is part of).
+# If not present is automatically filled by the tooling with the issue linked to the PR number.
+# issue: https://github.com/owner/repo/1234

x-pack/filebeat/input/entityanalytics/provider/activedirectory/internal/activedirectory/activedirectory.go

@@ -23,6 +23,141 @@ var (
 	ErrUsers                    = errors.New("failed to get user details")
 )
 
+// parsedBaseDN holds the result of parsing a base DN for potential group components.
+type parsedBaseDN struct {
+	// containerBaseDN is the container portion of the DN (OU/DC components).
+	containerBaseDN string
+	// potentialGroupDNs are CN components that might be groups (need validation).
+	potentialGroupDNs []string
+	// originalBaseDN is the original base DN string.
+	originalBaseDN string
+}
+
+// parseBaseDN analyzes a distinguished name and separates potential group (CN)
+// components from container components (OU, DC). CN components that appear
+// before container components are extracted as potential group references
+// that need to be validated against LDAP.
+//
+// For example, given:
+//
+//	CN=Admin Users,OU=Groups,DC=example,DC=com
+//
+// This returns:
+//   - containerBaseDN: "OU=Groups,DC=example,DC=com" (the container path)
+//   - potentialGroupDNs: ["CN=Admin Users,OU=Groups,DC=example,DC=com"]
+//
+// The potential groups must be validated with validateGroupDNs() to confirm
+// they are actually groups (objectClass=group) and not containers.
+func parseBaseDN(base *ldap.DN) parsedBaseDN {
+	result := parsedBaseDN{}
+	if base == nil || len(base.RDNs) == 0 {
+		return result
+	}
+
+	result.originalBaseDN = base.String()
+
+	// Find where container components (OU, DC) start.
+	// CN components before containers are treated as potential group references.
+	containerStart := -1
+	for i, rdn := range base.RDNs {
+		if len(rdn.Attributes) == 0 {
+			continue
+		}
+		attrType := strings.ToUpper(rdn.Attributes[0].Type)
+		if attrType == "OU" || attrType == "DC" {
+			containerStart = i
+			break
+		}
+	}
+
+	// If no container components found, or CN components don't precede them,
+	// use the base DN as-is.
+	if containerStart <= 0 {
+		result.containerBaseDN = result.originalBaseDN
+		return result
+	}
+
+	// Extract potential group DNs (CN components before container start).
+	for i := 0; i < containerStart; i++ {
+		rdn := base.RDNs[i]
+		if len(rdn.Attributes) == 0 {
+			continue
+		}
+		attrType := strings.ToUpper(rdn.Attributes[0].Type)
+		if attrType == "CN" {
+			// Build the full DN for this potential group by including it
+			// and all RDNs after it (the container path).
+			groupRDNs := base.RDNs[i:]
+			groupDN := &ldap.DN{RDNs: groupRDNs}
+			result.potentialGroupDNs = append(result.potentialGroupDNs, groupDN.String())
+		}
+	}
+
+	// Build the container base DN (starting from first OU or DC).
+	containerRDNs := base.RDNs[containerStart:]
+	containerBase := &ldap.DN{RDNs: containerRDNs}
+	result.containerBaseDN = containerBase.String()
+
+	return result
+}
+
+// validateGroupDNs queries LDAP to verify which of the potential group DNs
+// are actually groups (objectClass=group) vs containers or other object types.
+// Returns only the DNs that are confirmed to be groups.
+func validateGroupDNs(conn *ldap.Conn, potentialGroupDNs []string) []string {
+	if len(potentialGroupDNs) == 0 {
+		return nil
+	}
+
+	var confirmedGroups []string
+	for _, dn := range potentialGroupDNs {
+		// Query LDAP to check if this DN is a group.
+		srch := &ldap.SearchRequest{
+			BaseDN:       dn,
+			Scope:        ldap.ScopeBaseObject, // Only check this specific object
+			DerefAliases: ldap.NeverDerefAliases,
+			SizeLimit:    1,
+			TimeLimit:    0,
+			TypesOnly:    false,
+			Filter:       "(objectClass=group)",
+			Attributes:   []string{"objectClass"},
+			Controls:     nil,
+		}
+
+		result, err := conn.Search(srch)
+		if err != nil {
+			// If the search fails (e.g., object doesn't exist), skip this DN.
+			continue
+		}
+
+		// If we got a result, this DN is a group.
+		if len(result.Entries) > 0 {
+			confirmedGroups = append(confirmedGroups, dn)
+		}
+	}
+
+	return confirmedGroups
+}
+
+// buildMemberOfFilter creates an LDAP memberOf filter from a list of group DNs.
+// Returns an empty string if no groups are provided.
+func buildMemberOfFilter(groupDNs []string) string {
+	if len(groupDNs) == 0 {
+		return ""
+	}
+
+	if len(groupDNs) == 1 {
+		return "(memberOf=" + ldap.EscapeFilter(groupDNs[0]) + ")"
+	}
+
+	// Multiple groups: use OR filter.
+	var parts []string
+	for _, dn := range groupDNs {
+		parts = append(parts, "(memberOf="+ldap.EscapeFilter(dn)+")")
+	}
+	return "(|" + strings.Join(parts, "") + ")"
+}
+
 // Entry is an Active Directory user entry with associated group membership.
 type Entry struct {
 	ID          string         `json:"id"`
@@ -45,6 +180,12 @@ type Entry struct {
 // users or (&(objectClass=computer)(objectClass=user)) for computers. When
 // since is a non-zero time.Time, the query will be conjugated with
 // (whenChanged>="<SINCETIME>") into a new query.
+//
+// If the base DN contains group (CN) components along with container (OU/DC)
+// components, the search will automatically extract the group DNs and add
+// memberOf filters to find users who are members of those groups. This is
+// necessary because groups are leaf objects in LDAP and don't contain users
+// as children in the directory tree hierarchy.
 func GetDetails(query, url, user, pass string, base *ldap.DN, since time.Time, userAttrs, grpAttrs []string, pagingSize uint32, dialer *net.Dialer, tlsconfig *tls.Config) ([]Entry, error) {
 	if base == nil || len(base.RDNs) == 0 {
 		return nil, fmt.Errorf("%w: no path", ErrInvalidDistinguishedName)
@@ -77,7 +218,25 @@ func GetDetails(query, url, user, pass string, base *ldap.DN, since time.Time, u
 		sinceFmtd = since.Format(denseTimeLayout)
 	}
 
-	baseDN := base.String()
+	// Parse the base DN to extract any CN components that might be groups.
+	// Groups are leaf objects in LDAP, so we need to search from the
+	// container base and filter by group membership.
+	parsed := parseBaseDN(base)
+
+	// Validate which CN components are actually groups (vs containers like CN=Users).
+	confirmedGroups := validateGroupDNs(conn, parsed.potentialGroupDNs)
+
+	// Determine the effective base DN and membership filter.
+	var baseDN, memberOfFilter string
+	if len(confirmedGroups) > 0 {
+		// We have confirmed groups - search from container and filter by membership.
+		baseDN = parsed.containerBaseDN
+		memberOfFilter = buildMemberOfFilter(confirmedGroups)
+	} else {
+		// No groups found - use the original base DN as-is.
+		// This handles containers like CN=Users which should use subtree search.
+		baseDN = parsed.originalBaseDN
+	}
 
 	// Get groups in the directory. Get all groups independent of the
 	// since parameter as they may not have changed for changed users.
@@ -92,9 +251,14 @@ func GetDetails(query, url, user, pass string, base *ldap.DN, since time.Time, u
 	}
 
 	// Get users in the directory...
+	// Build the user filter by combining the base query with any group
+	// membership filter (from CN components in base DN) and time filter.
 	userFilter := query
+	if memberOfFilter != "" {
+		userFilter = "(&" + query + memberOfFilter + ")"
+	}
 	if sinceFmtd != "" {
-		userFilter = "(&" + query + "(whenChanged>=" + sinceFmtd + "))"
+		userFilter = "(&" + userFilter + "(whenChanged>=" + sinceFmtd + "))"
 	}
 	usrs, err := search(conn, baseDN, userFilter, userAttrs, pagingSize)
 	if err != nil {
@@ -126,7 +290,12 @@ func GetDetails(query, url, user, pass string, base *ldap.DN, since time.Time, u
 				for i, u := range modGrps {
 					modGrps[i] = "(memberOf=" + u + ")"
 				}
-				usrs, err := search(conn, baseDN, "(&"+query+"(|"+strings.Join(modGrps, "")+")", userAttrs, pagingSize)
+				changedGrpFilter := "(&" + query + "(|" + strings.Join(modGrps, "") + "))"
+				// Also include the base DN membership filter if present.
+				if memberOfFilter != "" {
+					changedGrpFilter = "(&" + changedGrpFilter + memberOfFilter + ")"
+				}
+				usrs, err := search(conn, baseDN, changedGrpFilter, userAttrs, pagingSize)
 				if err != nil {
 					errs = append(errs, fmt.Errorf("failed to collect users of changed groups%w: %w", ErrUsers, err))
 				} else {

x-pack/filebeat/input/entityanalytics/provider/activedirectory/internal/activedirectory/activedirectory_test.go

@@ -17,6 +17,141 @@ import (
 
 var logResponses = flag.Bool("log_response", false, "use to log users/groups returned from the API")
 
+func TestParseBaseDN(t *testing.T) {
+	// The ldap library normalizes attribute types to lowercase when
+	// serializing DNs, so expected values use lowercase cn, ou, dc.
+	tests := []struct {
+		name                  string
+		baseDN                string
+		wantContainerBaseDN   string
+		wantPotentialGroupDNs []string
+		wantOriginalBaseDN    string
+	}{
+		{
+			name:                  "OU only - no potential groups",
+			baseDN:                "OU=Users,DC=example,DC=com",
+			wantContainerBaseDN:   "ou=Users,dc=example,dc=com",
+			wantPotentialGroupDNs: nil,
+			wantOriginalBaseDN:    "ou=Users,dc=example,dc=com",
+		},
+		{
+			name:                  "DC only - no potential groups",
+			baseDN:                "DC=example,DC=com",
+			wantContainerBaseDN:   "dc=example,dc=com",
+			wantPotentialGroupDNs: nil,
+			wantOriginalBaseDN:    "dc=example,dc=com",
+		},
+		{
+			name:                  "CN before OU - extracts potential group",
+			baseDN:                "CN=Admin Users,OU=Groups,DC=example,DC=com",
+			wantContainerBaseDN:   "ou=Groups,dc=example,dc=com",
+			wantPotentialGroupDNs: []string{"cn=Admin Users,ou=Groups,dc=example,dc=com"},
+			wantOriginalBaseDN:    "cn=Admin Users,ou=Groups,dc=example,dc=com",
+		},
+		{
+			name:                  "CN before DC - extracts potential group",
+			baseDN:                "CN=Domain Admins,DC=example,DC=com",
+			wantContainerBaseDN:   "dc=example,dc=com",
+			wantPotentialGroupDNs: []string{"cn=Domain Admins,dc=example,dc=com"},
+			wantOriginalBaseDN:    "cn=Domain Admins,dc=example,dc=com",
+		},
+		{
+			name:                  "nested OU - no potential groups",
+			baseDN:                "OU=IT,OU=Departments,DC=example,DC=com",
+			wantContainerBaseDN:   "ou=IT,ou=Departments,dc=example,dc=com",
+			wantPotentialGroupDNs: nil,
+			wantOriginalBaseDN:    "ou=IT,ou=Departments,dc=example,dc=com",
+		},
+		{
+			name:                  "CN Users container - extracts as potential group",
+			baseDN:                "CN=Users,DC=example,DC=com",
+			wantContainerBaseDN:   "dc=example,dc=com",
+			wantPotentialGroupDNs: []string{"cn=Users,dc=example,dc=com"},
+			wantOriginalBaseDN:    "cn=Users,dc=example,dc=com",
+		},
+		{
+			name:                  "complex path with CN",
+			baseDN:                "CN=Security Team,OU=IT Groups,OU=Groups,DC=corp,DC=example,DC=com",
+			wantContainerBaseDN:   "ou=IT Groups,ou=Groups,dc=corp,dc=example,dc=com",
+			wantPotentialGroupDNs: []string{"cn=Security Team,ou=IT Groups,ou=Groups,dc=corp,dc=example,dc=com"},
+			wantOriginalBaseDN:    "cn=Security Team,ou=IT Groups,ou=Groups,dc=corp,dc=example,dc=com",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			base, err := ldap.ParseDN(tt.baseDN)
+			if err != nil {
+				t.Fatalf("failed to parse test DN %q: %v", tt.baseDN, err)
+			}
+
+			got := parseBaseDN(base)
+
+			if got.containerBaseDN != tt.wantContainerBaseDN {
+				t.Errorf("parseBaseDN() containerBaseDN = %q, want %q", got.containerBaseDN, tt.wantContainerBaseDN)
+			}
+			if got.originalBaseDN != tt.wantOriginalBaseDN {
+				t.Errorf("parseBaseDN() originalBaseDN = %q, want %q", got.originalBaseDN, tt.wantOriginalBaseDN)
+			}
+			if len(got.potentialGroupDNs) != len(tt.wantPotentialGroupDNs) {
+				t.Errorf("parseBaseDN() potentialGroupDNs length = %d, want %d", len(got.potentialGroupDNs), len(tt.wantPotentialGroupDNs))
+			} else {
+				for i, dn := range got.potentialGroupDNs {
+					if dn != tt.wantPotentialGroupDNs[i] {
+						t.Errorf("parseBaseDN() potentialGroupDNs[%d] = %q, want %q", i, dn, tt.wantPotentialGroupDNs[i])
+					}
+				}
+			}
+		})
+	}
+}
+
+func TestParseBaseDNNil(t *testing.T) {
+	got := parseBaseDN(nil)
+	if got.containerBaseDN != "" || got.originalBaseDN != "" || len(got.potentialGroupDNs) != 0 {
+		t.Errorf("parseBaseDN(nil) = %+v, want empty struct", got)
+	}
+
+	emptyDN := &ldap.DN{}
+	got = parseBaseDN(emptyDN)
+	if got.containerBaseDN != "" || got.originalBaseDN != "" || len(got.potentialGroupDNs) != 0 {
+		t.Errorf("parseBaseDN(empty) = %+v, want empty struct", got)
+	}
+}
+
+func TestBuildMemberOfFilter(t *testing.T) {
+	tests := []struct {
+		name     string
+		groupDNs []string
+		want     string
+	}{
+		{
+			name:     "empty",
+			groupDNs: nil,
+			want:     "",
+		},
+		{
+			name:     "single group",
+			groupDNs: []string{"cn=Admin Users,ou=Groups,dc=example,dc=com"},
+			want:     "(memberOf=cn=Admin Users,ou=Groups,dc=example,dc=com)",
+		},
+		{
+			name:     "multiple groups",
+			groupDNs: []string{"cn=Admins,dc=example,dc=com", "cn=Users,dc=example,dc=com"},
+			want:     "(|(memberOf=cn=Admins,dc=example,dc=com)(memberOf=cn=Users,dc=example,dc=com))",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := buildMemberOfFilter(tt.groupDNs)
+			if got != tt.want {
+				t.Errorf("buildMemberOfFilter() = %q, want %q", got, tt.want)
+			}
+		})
+	}
+}
+
 // Invoke test with something like this:
 //
 //	AD_BASE=CN=Users,DC=<servername>,DC=local AD_URL=ldap://<ip> AD_USER=CN=Administrator,CN=Users,DC=<servername>,DC=local AD_PASS=<passwort> go test -v -log_response