nested group membership

[christianrc]

Hello,

I have the following configuration:

AUTH_LDAP_USER_FLAGS_BY_GROUP = {

"is_staff": "cn=intranet-editors,ou=groups,dc=ntdomain,dc=local",

}

AUTH_LDAP_GROUP_SEARCH = LDAPSearch("dc=ntdomain,dc=local",

    ldap.SCOPE_SUBTREE, "(objectClass=*)"

)

AUTH_LDAP_GROUP_TYPE = NestedActiveDirectoryGroupType()

If a user is a member of group A, and group A is a member of Group B, will AUTH_LDAP_USER_FLAGS_BY_GROUP recognize all users of both group A and group B as matches? If not what would be a solution for this sort of arrangement?

Here is my log:

search_s('dc=ntdomain,dc=local', 2, '(&(objectClass=*)(|(member=CN=zz test02,CN=Users,DC=NTDOMAIN,DC=LOCAL)))') returned 2 objects: CN=Restricted Internet Use,OU=Groups,DC=NTDOMAIN,DC=LOCAL; CN=RestrictedInternet,OU=Groups,DC=NTDOMAIN,DC=LOCAL

search_s('dc=ntdomain,dc=local', 2, '(&(objectClass=*)(|(member=CN=Restricted Internet Use,OU=Groups,DC=NTDOMAIN,DC=LOCAL)(member=CN=RestrictedInternet,OU=Groups,DC=NTDOMAIN,DC=LOCAL)))') returned 1 objects: CN=intranet-editors,OU=Groups,DC=NTDOMAIN,DC=LOCAL

search_s('dc=ntdomain,dc=local', 2, '(&(objectClass=*)(|(member=CN=intranet-editors,OU=Groups,DC=NTDOMAIN,DC=LOCAL)))') returned 0 objects: 

CN=zz test02,CN=Users,DC=NTDOMAIN,DC=LOCAL is not a member of cn=intranet-editors,ou=groups,dc=ntdomain,dc=local

***

'Restricted Internet Use' is a member of 'intranet-editors'

Thanks!

[christianrc]

I solved this with a signal/listener. Looked up the groups and updated the User when he is included in the correct nested group.

I still be interested in know if there is another way.

[Peter Sagerson]

I suspect you're hitting a DN normalization bug. If you don't mind, I'll send you a build privately and we'll see if we can get this working a bit better.

[hgregorian]

Peter,

I believe I'm running into the same issue as christianrc.  Would you be able to share a build that possibly provides a fix?

Thanks,

--Heig

[Peter Sagerson]

Version 1.1.2 fixes a DN normalization issue that was impacting nested groups on AD. Thanks to Heig for a real-world test.

[Di majo]

MT103/202 DIRECT WIRE TRANSFER
PAYPAL TRANSFER
CASHAPP TRANSFER
ZELLE TRANSFER
LOAN DEAL
TRANSFER WISE
WESTERN UNION TRANSFER
BITCOIN FLASHING
BANK ACCOUNT LOADING/FLASHING
IBAN TO IBAN TRANSFER
MONEYGRAM TRANSFER
IPIP/DTC
SLBC PROVIDER
CREDIT CARD TOP UP
DUMPS/ PINS
SEPA TRANSFER
WIRE TRANSFER
BITCOIN TOP UP
GLOBALPAY INC US
SKRILL USA
UNIONPAY RECEIVER

Thanks.


NOTE; ONLY SERIOUS / RELIABLE RECEIVERS CAN CONTACT.

DM ME ON WHATSAPP
+44 7529 555638