Open janmayer opened 6 years ago
I'd say that
if
branch you chose because in fact, the primary group in Linux, is another one than the list of groups the user is member ofYou could probably just push a real PR.
Just had a look at information from an Active Directory and there is no gidnumber
column returned. I wonder if this is related to Active Directory vs OpenLDAP or if this column may not be present in either cases.
Possibly independently of this answer, I wonder if this should be added as a configuration option; something like "Include group membership from user's primary group ID"?
@xperseguers , the gidNumber attribute is part of the NIS Schema extension described in RFC2307. If this schema extension is activated in any given LDAP server, you can use it (but you don't have to) - depends on how the LDAP data is structured in a given organization.
One should expect a lot of LDAP servers used in a unix environment to be set up with that extension. Not sure whether OpenLDAP has it enabled by default but I would think so. It's not enabled in a native AD and I'd guess it is used there rarely (but it can be added and used).
Long story short: the coloumn may or may not be present in either case (AD vs OpenLDAP [vs random LDAP server]), so if support for gidNumber would be added, making its configurable would be a strong suggestion. Even if it's supported, there may be cases where some users have a gidNumber while others have not (e.g. an AD serving Windows and Unix machines with some users Windows only and others on Unix or on both.
@janmayer
A lot of organizations I'm aware of play it save and put members explicitly into the group represented by the gidNumber as a lot of LDAP coupled tools are unaware of gidNumber.
In the ldap system I integrate typo3 with, each user has a primary usergroup via
<gidnumber>
, but this group is not in the<memberOf>
list. I need both group membership sources for correct permissions.I have currently jury-rigged this in via
Is there a better / official way to do this?
Thanks.