| f17bb68b | 28-Jul-2021 |
Andreas Gohr <andi@splitbrain.org> |
new approach for recursive groups
Instead of implementing the recursion client side, we ask the AD server
to resolve nested group memberships for us. This saves potentially many
network requests but
new approach for recursive groups
Instead of implementing the recursion client side, we ask the AD server
to resolve nested group memberships for us. This saves potentially many
network requests but may have performance penalties on the AD server
side. However it ensures, we can't make a mistake and thus makes our
code safer to run - also turns out my first attempt was checking nested
groups backwards.
See https://stackoverflow.com/q/40024425 for more discussions on
performance for this.
A config option allows to use the former much faster approach for setups
without nested groups.
Still to do: supporting user lookups by group this way.
show more ...
|
| c2500b44 | 15-Jul-2021 |
Andreas Gohr <andi@splitbrain.org> |
make the primary group configurable
Because the Domain Users group can be localized, this makes it
configurable. The authAD library had a config to use "real" primary
groups where it would look up t
make the primary group configurable
Because the Domain Users group can be localized, this makes it
configurable. The authAD library had a config to use "real" primary
groups where it would look up the primary group by calculating the SID
and doing another check. We could copy that mechanism if needed later
on.
show more ...
|