<shrug> That seems definitive.
You LDAP design is way too complicated. The multiple LDAP directories
and groups buried within groups makes it nearly impossible to create a
working RADIUS system.
Maybe someone more familiar with LDAP magic can say more. But my
$0.02 is to ensure that your database actually stores user data. All of
it. In a sane format.
Even if you do fix the group membership issue, the repeated LDAP
searches will DESTROY performance. You'll be lucky to get 10
authentications per second out of it.
Depends. If the child groups reference the parent in some way, it's only
one extra search. But that only gets you one level of nesting. Anything
beyond that gets insanely slow. Anyway it's not supported currently and
I don't think it'd be a sensible thing to add support for.
I think Phil mentioned something about a magic attribute you could
search for in AD (with all those rebinds i'm guessing this is AD)
which supported nested grouping.
I started to look at adding it, and wrote most of the code, but didn't
have time to finish it.
If Phil can confirm that, that feature would help in this situation, I'll
finish it off and merge the code.