Bug: ingestion omits adding MemberOf edges on AUTHENTICATED USERS group for principals of child domains

[jmbesnard]

Description:

After ingestion of json files, data in neo4j show that AUTHENTICATED USERS groups contains only the DOMAIN COMPUTERS and DOMAIN USERS groups of the current domain whereas it should also contain the ones of child domains.
In BH legacy, the ingestion included not only child domains but also any domain with a trust (which was incorrect too).

Are you intending to fix this bug?

No

Component(s) Affected:

• API

Steps to Reproduce:

Ingest data from a forest and check what objects have MemberOf edges towards the AUTHENTICATED USERS group of the root domain

Expected Behavior:

Should contain DOMAIN COMPUTERS and DOMAIN USERS also of child domains

Actual Behavior:

Contains only of current domain

Screenshots/Code Snippets/Sample Files:

Environment Information:

BloodHound: 5.15

Collector: SH, any version
OS: GNU/Linux

Additional Information:

Potential Solution (optional):

Related Issues:

Contributor Checklist:

[rvazarkar]

I believe we've got some upcoming work on the actual behavior of Auth Users/Everyone across trusts so we can properly model this