On Thu, Mar 25, 2021 at 9:01 AM Chris Wopat <me@falz.net> wrote: [snipped]
Note that this will do a single match and bail out of the if statement. What we'd like to do is to keep matching accumulatively. The use case is per above it's layer2/3 devices, we'd like to add some other types of gear to the list where someone in the above groups shouldnt have access to, but someone in network-administrators AND $othergroup should have access to.
Per Unlang, it looks like there is a case/switch statement but I believe we'd be hitting the same limitation there.
tldr; how can we match multiple LDAP-groups and get reply-items from all that match?
Chris, Thank you for posting your snippet, as it was helpful for me to develop a similar setup in my org. :) I've been doing some reading on LDAP-Group, and from what I could find, switch/case doesn't work with it. I'm not entirely sure why, but I saw Alan explicitly tell someone else to use if/elseif instead... that reply was also from several years back, so maybe that's no longer accurate? Have you considered using nested ifs to query twice for the "network-admins AND $othergroup" scenario? If you're concerned about LDAP load / query time, you can enable caching in the ldap module; then the LDAP-Group list is saved and lookups happen against the cache instead of being re-queried each time you ask for it. I'd suggest investigating the syntax "&LDAP-Group[*]" as it seems to be preferred over just "LDAP-Group", as well. Regards, Braden