Nested groupmembers

[kvvloten]

Hi,

I want to connect Linshare with Samba-AD. Since I have setup RBAC, users are normally indirect members of access-groups (workgroups in Linshare).
In order to get indirect members, the query should be something like:

(&(objectCategory=person)(memberof:1.2.840.113556.1.4.1941:=CN=workgroup,<base-dn>))

How can I get workgroups to query for nested groupmembers ?

• Kees.

[wboudiche]

Hi kvvloten,
Thank you for using LinShare, did you take a look at this link :
https://github.com/linagora/linshare/blob/master/documentation/EN/administration/ldap.md

[kvvloten]

I am aware of that doc file.
The examples are just showing groups with direct members, like this:

dn: cn=workgroup-wg-1,ou=Groups,dc=linshare,dc=org
cn: workgroup-wg-1
objectClass: posixGroup
member: uid=user1,ou=People,dc=linshare,dc=org
member: uid=user2,ou=People,dc=linshare,dc=org

For RBAC I would make a group (representing a role) member of cn=workgroup-wg-1,ou=Groups,dc=linshare,dc=org and then users are added to the role-group. In some cases there are even more layers of groups.
In order to get nested members of a group, e.g. workgroup-wg-1, the ldap (AD) query would be:

(&(objectCategory=person)(memberof:1.2.840.113556.1.4.1941:=cn=workgroup-wg-1,ou=Groups,dc=linshare,dc=org))

It will return a list of DNs of users that are direct or indirect members of workgroup-wg-1.
For RBAC it would be really helpful to have support for this. Unfortunately it is not mentioned in the docs (as far as I could see), so that's the reason to ask here.

How do I do this or are nested groups unsupported?

• Kees.