On Oct 13, 2016, at 9:42 AM, Alan DeKok <aland@deployingradius.com> wrote:
On Oct 13, 2016, at 9:38 AM, Brian Candler <b.candler@pobox.com> wrote:
I am testing out freeradius with FreeIPA (= 389 directory server). This is freeradius-3.0.11 from Ubuntu 16.04, talking to FreeIPA under CentOS 7.
The 389 directory server in FreeIPA has a "memberOf" plugin installed (by default), which exposes all the groups as part of the user record. For example:
...
The problem is, whenever I touch the LDAP-Group attribute it triggers off a whole load of LDAP queries, one for each group, to translate the group DN to the cn.
Specify the group as a DN and it won't do the translation. If you want to examine the DN values yourself using a foreach loop, toggle on cacheable_dn, all the membership DNs will then be available as LDAP-Group instances. I can see some advantages do extracting groups from the RDN, so feel free to add an issue ticket. -Arran