# Support for nested groups

**URL:** <https://forum.pritunl.com/t/support-for-nested-groups/1723>\
**Category:** Pritunl VPN\
**Tags:** pritunl\
**Created:** [January 23, 2024, 10:25am UTC](https://forum.pritunl.com/t/support-for-nested-groups/1723 "2024-01-23T10:25:16Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jonathan](https://forum.pritunl.com/user_avatar/forum.pritunl.com/jonathan/32/657_2.png) [@Jonathan](https://forum.pritunl.com/u/Jonathan)\
**Post date:** [January 23, 2024, 10:25am UTC](https://forum.pritunl.com/t/support-for-nested-groups/1723/1 "2024-01-23T10:25:16Z")

</div>

I was wondering if there is any support for, or planned way to support nested groups? The setup we are running is using google as our SSO, and set the `app.sso_google_mode` to ‘“groups”’. The issue that we are having is that if a user is part of group X, and group X is added to group Y, where group Y is what is configured in pritunl, the user cannot access pritunl. Am i missing something, or is this a limitation somewhere?

---

<div class="post-metadata">

**Author:** ![zach](https://forum.pritunl.com/user_avatar/forum.pritunl.com/zach/32/1105_2.png) [@zach](https://forum.pritunl.com/u/zach)\
**Post date:** [January 23, 2024, 1:53pm UTC](https://forum.pritunl.com/t/support-for-nested-groups/1723/2 "2024-01-23T13:53:46Z")

</div>

I don’t see anything in the Google API to retrieve nested groups this likely won’t be added.

---

<div class="post-metadata">

**Author:** ![busser](https://forum.pritunl.com/user_avatar/forum.pritunl.com/busser/32/662_2.png) [@busser](https://forum.pritunl.com/u/busser)\
**Post date:** [March 22, 2024, 11:02am UTC](https://forum.pritunl.com/t/support-for-nested-groups/1723/3 "2024-03-22T11:02:54Z")

</div>

Perhaps the Pritunl server could search for a user’s groups recursively, up to a certain depth? A depth of 0 would be equivalent to the current behaviour where only a user’s direct group memberships are taken into account.

In Google Workspace, groups are also entities. We should be able to list the groups a group is a member of and recurse up to a point.

Hashicorp Vault does this for GSuite OIDC auth, for instance: [vault-plugin-auth-jwt/provider\_gsuite.go at ab76cf59ee3962b406c617fcc6b8d4ee1dbdcb6e · hashicorp/vault-plugin-auth-jwt · GitHub](https://github.com/hashicorp/vault-plugin-auth-jwt/blob/ab76cf59ee3962b406c617fcc6b8d4ee1dbdcb6e/provider_gsuite.go#L181)

Do you think this could be feasible?