Hello,

nested groups that don't belong to the scope defined by the Base DN will not be resolved properly by the integration client.
I suspect that although the nested groups are qualified in the directory as distinguished names, the BaseDN (which is not ancestor to the nested group) filter will be applied and thus no data is returned to the client application.

I would recommend mentioning this detail explicitly in the documentation as well as lifting this limitation in a future iteration of Crowd.

Best Regards,
Edoardo