We're using reverse-proxy-auth plugin for authentication and role-strategy-plugin for authorization.

The users connect to apache httpd 2.4 which authenticates against Windows 2008 R2 active directory and passes user authentication to Tomcat/Jenkins.

In Jenkins the reverse-proxy-auth-plugin accesses active directory using its LDAP configuration to lookup a users groups.

This works fine for groups in which the user is directly listed as member.
When the user is member of group "A" and group "A" is member of group "B" which itself is member of group "C", then we don't get those "nesting parents" ("B" + "C") recognized for authorization purposes which causes permissions not to be granted.