x-pack/filebeat/input/entityanalytics/provider/internal/activedirecto…

…ry: relax base DN constraint

Apparently the base DN prefixes used in the wild are not restricted to
CN=Users, so remove that check in the query.

CHANGELOG.next.asciidoc

@@ -290,6 +290,7 @@ https:/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff]
 - Update CEL mito extensions to v1.13.0 {pull}40035[40035]
 - Add Jamf entity analytics provider. {pull}39996[39996]
 - Add ability to remove request trace logs from http_endpoint input. {pull}40005[40005]
+- Relax constraint on Base DN in entity analytics Active Directory provider. {pull}40054[40054]
 
 *Auditbeat*
 

x-pack/filebeat/input/entityanalytics/provider/activedirectory/internal/activedirectory/activedirectory.go

@@ -23,8 +23,6 @@ var (
  ErrUsers = errors.New("failed to get user details")
 )
 
-var cnUsers = &ldap.RelativeDN{Attributes: []*ldap.AttributeTypeAndValue{{Type: "CN", Value: "Users"}}}
-
 // Entry is an Active Directory user entry with associated group membership.
 type Entry struct {
  ID string `json:"id"`
@@ -45,10 +43,6 @@ func GetDetails(url, user, pass string, base *ldap.DN, since time.Time, pagingSi
  if base == nil || len(base.RDNs) == 0 {
  return nil, fmt.Errorf("%w: no path", ErrInvalidDistinguishedName)
  }
- baseDN := base.String()
- if !base.RDNs[0].Equal(cnUsers) {
- return nil, fmt.Errorf("%w: %s does not have %s", ErrInvalidDistinguishedName, baseDN, cnUsers)
- }
 
  var opts []ldap.DialOpt
  if dialer != nil {
@@ -77,6 +71,8 @@ func GetDetails(url, user, pass string, base *ldap.DN, since time.Time, pagingSi
  sinceFmtd = since.Format(denseTimeLayout)
  }
 
+ baseDN := base.String()
+
  // Get groups in the directory. Get all groups independent of the
  // since parameter as they may not have changed for changed users.
  var groups directory