documentation for ldap nested groups

conf/ldap.toml

@@ -28,6 +28,23 @@ search_base_dns = ["dc=grafana,dc=org"]
 # This is done by enabling group_search_filter below. You must also set member_of= "cn"
 # in [servers.attributes] below.
 
+# Users with nested/recursive group membership must have an LDAP server that supports LDAP_MATCHING_RULE_IN_CHAIN
+# and set group_search_filter below in such a way that it returns the groups the submitted username is a member of.
+#
+# Nested Groups + Active Directory (AD) Example:
+#
+#   AD groups store the Distinguished Names (DNs) of members, so your filter will need to know the DN
+#   for the user based only on the submitted username. Multiple DN templates can be
+#   searched by combining filters with the LDAP or operator.
+#
+#   Some examples:
+#     group_search_filter = "(member:1.2.840.113556.1.4.1941:=CN=%s,[user container/OU])"
+#     group_search_filter = "(|(member:1.2.840.113556.1.4.1941:=CN=%s,[user container/OU])(member:1.2.840.113556.1.4.1941:=CN=%s,[another user container/OU]))"
+#
+#   You might also want to change member_of in [servers.attributes] to "distinguishedName". This
+#   does not appear to be necessary but it will show you more accurate group membership if
+#   verbose_logging is enabled.
+
 ## Group search filter, to retrieve the groups of which the user is a member (only set if memberOf attribute is not available)
 # group_search_filter = "(&(objectClass=posixGroup)(memberUid=%s))"
 ## An array of the base DNs to search through for groups. Typically uses ou=groups