Group Base Dn
A group base dn is the starting point in your directory where apps look for groups. You set it up by pointing your app to the exact folder that holds team roles. Many teams point this setting to the very top of their directory tree at first. That broad scope pulls in every group and slows down login checks across your apps. Worse, a wide search can match test groups or admin roles by mistake during login. How a group base dn works in directory lookups Directory servers store users and groups
Minimal Base Images: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
A group base dn is the starting point in your directory where apps look for groups. You set it up by pointing your app to the exact folder that holds team roles. Many teams point this setting to the very top of their directory tree at first. That broad scope pulls in every group and slows down login checks across your apps. Worse, a wide search can match test groups or admin roles by mistake during login.
How a group base dn works in directory lookups
Directory servers store users and groups in a tree of nested folders. Each folder and item in the tree has a unique path called a distinguished name. When a user logs into an app, the app checks the directory for that user. Next, the app must find which groups include that user as a member.
The group base dn tells the app where to start that group search. Instead of reading the whole directory, the app only reads below that specific starting point. You usually point this path to a dedicated security groups folder in your directory tree. The app then pairs the base path with a search filter to find matching groups. It reads the member list of each group beneath that folder and maps roles.
How to scope your directory tree for group lookups
Start by looking at how your team organizes folders inside your directory server. Good directory designs separate user accounts from security groups in different branches of the tree. They also split groups by purpose, such as mail lists versus app role groups. Find the lowest folder in the tree that still holds all needed app groups.
Set that specific folder path as your base for group lookups in your app settings. Next, pick a search scope that matches how your folders sit under that base path. A one-level scope checks only the groups directly inside that single target folder. A subtree scope checks the main folder and every child folder nested underneath it. If your teams use nested groups for roles, make sure your app supports recursive lookups. Always test the lookup with a standard user account before saving your changes for everyone.
Minimal Base Images: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
What directory group mapping solves and what it misses
Scoping your directory path solves two big problems for platform and security teams right away. First, it makes logins much faster because the directory server searches fewer records each time. Second, it stops apps from reading old or unrelated groups outside the security branch. Your app maps only the groups you meant to expose to its internal roles.
Still, directory group mapping only decides who can log in and which coarse role applies. Once a user logs into a database or server, directory groups step out of the way. A group check does not inspect the actual queries or commands a user runs next. If a developer belongs to a broad database group, they can run any allowed query. Directory groups also do not mask sensitive data like emails, phone numbers, or card numbers. Teams need controls that check individual requests and rewrite sensitive fields in query results.
Govern statements and responses across databases and APIs
Good config and scoped roles are needed setup. They do not check single queries in flight or mask sensitive fields in returned rows. Across Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, and internal HTTP endpoints, hoop.dev runs beside each supported service as an open-source proxy, a sidecar for your database or API.
First, hoop.dev guardrails block banned queries before they run. Then hoop.dev data masking rewrites matched sensitive values in responses in memory. The audit trail records every statement and verdict per resource. Furthermore, hoop.dev holds SOC 2 Type II and is open source on GitHub.
Frequently asked questions
What is the difference between a user base path and a group base dn?
A user base path tells the app where to find person accounts during login. A group base dn tells the app where to look up role memberships after login.
What happens if I set the group path too high in the tree?
The directory server must scan every branch below that point during each user login. This slows down login times and can pull unwanted groups into your app roles.
Why are some of my users missing their roles after logging in?
Their groups likely sit in a sibling folder outside your current group search path. Move those groups into the target folder or adjust your search scope to include child folders.