By tqb on

I’m about to complete successfully the installation of Drupal. I’m using it with a Windows 2000 server Active Directory and also the LDAP integration, groups & data module. All modules run correctly and the Drupal’s roles mapping for LDAP groups too but I’ve a problem with persons who are in a LDAP “group of group”: I’m using the group A and the group B from Active Directory, then I map those groups to Drupal’s roles A & B : No problem ! But if a person is in a group C, who is in the group B (or A) no group is assigned to this user... I want to use a recursive search to find out the different names (like group B) of the “MemberOf” attribute of Active Directory and assign this group to the user. Is it a good Idea? Can anybody help me?

⋅ Categories: Drupal 5.x

Comments

djflux’s picture

djflux commented

I've done that with Zope in python so it can be done. I used recursion on the memberOf AD attribute. Never even looked at the PHP code in the LDAP module.

A couple of caveats of which you should be aware:

- If/when you implement this code make sure there are checks in the code for loops. For example group A is in group B which is in group C. Then group C is placed into group A. You now have a circular loop in your embedding which cause havoc if you're using recursion.

- Consider having a filter on which AD groups are imported as roles. I've never used the LDAP groups module for Drupal so the module may already have the ability to filter.

- Caching: again, the LDAP module may already provide this functionality, but if it doesn't and you have a huge number of groups in AD (as we do), your lookups will take quite a bit of time