> Source: [sk66561](https://support.checkpoint.com/results/sk/sk66561)

# sk66561 - Controlling LDAP Nested groups configuration in Identity Awareness

| Property | Value |
|----------|-------|
| Solution ID | sk66561 |
| Date Created | 2012-01-16 |
| Last Modified | 2019-10-31 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |

## Solution

Prior to R75.40, LDAP nested groups were not supported. LDAP users were matched to LDAP groups that they explicitly belonged to. For example:

User *John* belongs to group *Org_IT* and the group *Org_IT* belongs to the group *Org_ALL* .  
John's implicit membership in *Org_ALL* will be disregarded by the Identity Server.

**Starting in R75.40, there is a full support for LDAP nested groups.**

* In R75.40, the feature is **disabled** by default.  

* **Starting from R76** the feature is **enabled** by default.

<br />

Once enabled, the default depth is 20. This feature can be manipulated using this CLI command:

*\[Expert@GW_HostName\]# pdp nested_groups*

Available options:

* *enable* - Enables the nested groups feature.
* *disable* - Disables the nested groups feature.
* *depth* - Sets a new depth. Minimum is 1 and maximum is 40.
* *status* - Display the current status of nested groups, enabled/disabled + the current depth.
* *show* - Displays a list of users for groups that were not fetched due to depth settings.   
  For example, if the depth is set to 3 and a user belongs to 5 groups (nested), group information will be retrieved only until depth 3. Other groups will be disregarded
* *clear* - Clears the list of users belonging to groups that were not fetched due to depth settings. For example, if the depth is set to 3 and a user belongs to 5 groups (nested), the list of users in group 4 and 5 will be cleared.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content