<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><br>On 24 Apr 2014, at 23:20, Alan DeKok <<a href="mailto:aland@deployingradius.com">aland@deployingradius.com</a>> wrote:<br><br><blockquote type="cite">Josh Essar wrote:<br><blockquote type="cite">I have having some problems with ldap group checking. Our students do<br>not have a common group that they are a member of. They are all a member<br>of a group based on their username (ST_Students for every student that<br>has a username that start with st). We then have groups based off each<br>letter of the alphabet (S_Students would contain the SA_Students through<br>SZ_Students groups). We then have another group called students, that<br>has the A_Students through Z_Students groups. <br></blockquote><br> That is an... inventive approach. I can honestly say I've never seen<br>that before.</blockquote><div><br></div><img id="irc_mi" style="margin-top: 0px;" class="irc_mut" width="490" height="393" apple-inline="yes" apple-width="yes" apple-height="yes" src="cid:0FCF123D-79C4-4C8C-BF19-EFE7F482829B@nelgarde.methodanalysis.com"><br><br><blockquote type="cite"><br><blockquote type="cite">(0) Performing unfiltered search in<br>'CN=GROUP5,OU=staff,OU=people,DC=our,DC=domain', scope 'base'<br>(0) Waiting for search result...<br>(0) Group name is "GROUP5"<br>rlm_ (ldap): Deleting connection (4)<br>(0) User is not a member of specified group<br></blockquote></blockquote><div><br></div>Debug FTW!<div><br><blockquote type="cite"> <shrug> That seems definitive.<br><br> You LDAP design is way too complicated. The multiple LDAP directories<br>and groups buried within groups makes it nearly impossible to create a<br>working RADIUS system.<br><br> Maybe someone more familiar with LDAP magic can say more. But my<br>$0.02 is to ensure that your database actually stores user data. All of<br>it. In a sane format.<br><br> Even if you do fix the group membership issue, the repeated LDAP<br>searches will DESTROY performance. You'll be lucky to get 10<br>authentications per second out of it.<br></blockquote><div><br></div><div>Depends. If the child groups reference the parent in some way, it's only</div><div>one extra search. But that only gets you one level of nesting. Anything</div><div>beyond that gets insanely slow. Anyway it's not supported currently and</div><div>I don't think it'd be a sensible thing to add support for.</div><div><br></div><div>I think Phil mentioned something about a magic attribute you could </div><div>search for in AD (with all those rebinds i'm guessing this is AD)</div><div>which supported nested grouping.</div><div><br></div><div>I started to look at adding it, and wrote most of the code, but didn't</div><div>have time to finish it.</div><div><br></div><div>If Phil can confirm that, that feature would help in this situation, I'll </div><div>finish it off and merge the code.</div><br><div>Arran Cudbard-Bell <<a href="mailto:a.cudbardb@freeradius.org">a.cudbardb@freeradius.org</a>><br>FreeRADIUS Development Team<br><br>FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2<br></div><br></div></body></html>