Francois Gaudreault wrote:
I have an LDAP xlat query to populate the Ldap-Group attribute
No. You can't do that. LDAP-Group is a *comparison* operator. It's meaning and behavior is defined. It does LDAP queries to check group membership against the string you return. DO NOT use it for any other purpose.
in order to do crazy stuff with the group membership (out of scope to explain you what kind of crazy stuff). The issue I have is that the query may return multiple group membership lines.
update request { Ldap-Group += "%{ldap:ldap:///dc=inverse,dc=local?memberOf?sub?sAMAccountName=%u}" }
My question is, how can the Ldap-Group be listed for each result the query return? ie. Ldap-Group = "cn=group1,dc=inverse,dc=local" Ldap-Group = "cn=group2,dc=inverse,dc=local"
Right now, the Ldap-Group will only contain the first group of the list.
(1) use a different attribute. Using LDAP-Group is wrong. (2) the %{ldap:...} query returns a one-line string. You *cannot* have it return more data. You *cannot* automatically create multiple attributes from one strings worth of data. This problem requires a real programming language. Use Perl. Alan DeKok.