LDAP Group Membership

[Josh Essar]

Alan DeKok wrote:

>   Don't use ridiculously complicated group memberships.

That is the approach I have decided to take. It's time to cleanup our group structure anyway.

>   The repeated rebinds mean that the information isn't in one LDAP
> directory, it's scattered across many directories.  i.e. Active Directory.
> 
>   Your design is *slow*.  Doing multiple binds just to discover a user
> is very problematic.
> 
>   You LDAP design is way too complicated.  The multiple LDAP directories
> and groups buried within groups makes it nearly impossible to create a
> working RADIUS system.
> 

Yes, we use Active Directory. I'm assuming it is an active directory
configuration change that will need to be made to reduce the number of
rebinds. Is there a configuration change I could make in freeradius to
make this process more efficient?

> 
>   Even if you do fix the group membership issue, the repeated LDAP
> searches will DESTROY performance.  You'll be lucky to get 10
> authentications per second out of it.

Would if be better to setup an openldap server and used that for
freeradius lookups? I had already thought about doing that when I
started this project.