Referral chasing

Expanded Definition

Referral chasing is a directory lookup behaviour where a client follows server-supplied pointers to other directory servers until the requested object is found or the search terminates. In legitimate deployments, it helps distribute directory data and improves lookup reachability, especially in federated or segmented environments. In NHI and IAM operations, the term matters because the client is not just querying one endpoint, it is also accepting directions about where to go next.

Definitions vary across vendors on how aggressively referral handling should continue, and there is no single standard governing safe limits across all directory clients. The core security issue is whether referral targets are trusted, bounded, and validated before follow-on requests are made. NIST’s control guidance on boundary protection and system monitoring in NIST SP 800-53 Rev 5 Security and Privacy Controls is relevant when referral following crosses trust boundaries or creates unexpected network paths. The most common misapplication is treating referral chasing as harmless by default, which occurs when client libraries follow attacker-influenced pointers without loop limits, target allowlists, or request caps.

Examples and Use Cases

Implementing referral chasing rigorously often introduces latency and trust-management overhead, requiring organisations to weigh directory reachability against the cost of extra validation and traffic control.

• A corporate LDAP client follows referrals from a global directory to regional directory servers so employee objects can be resolved without replicating all data everywhere.
• An identity platform receives a referral to another namespace during service-account lookup, but the client enforces an allowlist to avoid following pointers outside the enterprise boundary.
• A misconfigured directory proxy enters a referral loop between two servers, causing repeated lookups that consume CPU and network bandwidth until rate limits intervene.
• Attackers manipulate directory responses so a client chases referrals toward an untrusted endpoint, turning a routine lookup into a traffic-amplification path.
• Teams reviewing Ultimate Guide to NHIs use referral handling as part of broader service-account governance because directory dependencies can hide where NHI resolution actually occurs.

Operationally, referral chasing is also discussed alongside directory hardening practices in the same NIST SP 800-53 Rev 5 Security and Privacy Controls guidance that supports controlled trust paths and monitored system communications.

Why It Matters in NHI Security

Referral chasing becomes a security concern when directory clients are allowed to make unbounded decisions about where to send follow-on queries. In NHI environments, that can expose service-account discovery paths, create denial-of-service conditions, or mask dependency chains that defenders need to understand. The risk is not the referral itself, but the combination of automatic follow-through, weak target validation, and insufficient loop detection. This matters especially where authentication services depend on directory resolution for tokens, certificates, or account metadata.

NHIMG notes that only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs, which makes hidden referral chains even harder to govern. When referral behaviour is not documented, defenders may misread normal lookup failures as identity outages, or miss the fact that an attacker is steering directory traffic toward a choke point. Mapping these flows alongside controls in NIST SP 800-53 Rev 5 Security and Privacy Controls helps establish monitoring, boundary validation, and rate-limiting expectations. Organisations typically encounter the operational cost only after a directory outage or traffic storm, at which point referral chasing becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• Why do Ponzi schemes often use referral incentives?
• Referral Fraud