LDAP Group Membership

[peter.geiser at id.unibe.ch]

Uhh - falsely meantŠ

Forward searching from user to group including nested groups also work:

(memberOf:1.2.840.113556.1.4.1941:=cn=Test,ou=East,dc=Domain,dc=com)


- Peter


Am 28.04.14 13:23 schrieb "Arran Cudbard-Bell" unter
<a.cudbardb at freeradius.org>:

>
>On 28 Apr 2014, at 06:35, peter.geiser at id.unibe.ch wrote:
>
>> :) There is no magic - it's all documented by Microsoft:
>> 
>> - MSDN: http://msdn.microsoft.com/en-us/library/aa746475(v=vs.85).aspx
>> - TechNet: 
>> 
>>https://social.technet.microsoft.com/wiki/contents/articles/5392.active-d
>>ir
>> ectory-ldap-syntax-filters.aspx
>> 
>> The query is really performant for what it do but on a FreeRadius Server
>> with heavy load you should use it in combination with the cache module.
>> We have this combination in production on Campus on since 6 month
>>without
>> any problems.
>> ~ 250'000 Autentications per day for 802.1x (EduRoam), VPN, ...
>
>Yes, there's another way to do it automatically too by looking for a
>special attribute in the user object.
>
>I'm just wondering if it's possible to specify the OID by it's text name,
>some of the other Microsoft documentation suggests it would be. Could
>someone try it and let me know?
>
>-Arran
>
>Arran Cudbard-Bell <a.cudbardb at freeradius.org>
>FreeRADIUS Development Team
>
>FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
>