Including the primary group of users.

[ednaldodias]

Look at

https://github.com/ednaldodias/django-auth-ldap-ad-primarygroup

django-auth-ldap-ad-primarygroup-main.zip

[ednaldodias]

Comments are welcome

[shane-oliver]

Hi ednaldodias,

Thanks for this - It fixed the issue. With your modifications using Microsoft AD a users "primaryGroupID" now is included with their "memberof" list of groups.

I notice that you change the ldap_user.attrs uid > distinguishedName is that a mandatory change ?

[ednaldodias]

Hi shane-oliver, Yes, it is mandatory to check if the user membership due to group nesting See in https://social.technet.microsoft.com/Forums/ie/en-US/f238d2b0-a1d7-48e8-8a60-542e7ccfa2e8/recursive-retrieval-of-all-ad-group-memberships-of-a-user?forum=ITCG 1. Using ADSISearcher and the LDAP_MATCHING_RULE_IN_CHAIN. This uses the LDAP syntax filter: (member:1.2.840.113556.1.4.1941:=$DN) where $DN is the distinguishedName of the user. This method: a. Reveals membership due to group nesting. b. Reveals both security and distribution groups. c. Does not reveal the "primary" group (or any groups the "primary" is a member of). This method requires one query of Active Directory. You can retrieve any attributes of the group you want without the need to bind to the individual group objects. 2. Using the tokenGroups attribute, a collection of security group SID values. This method: a. Reveals membership due to group nesting. b. Reveals only security groups, not distribution groups. c. Reveals the "primary" group (and any groups the "primary" group is a member of). This method requires binding to one object in Active Directory to retrieve the tokenGroups attibute. However, the values retrieved are SID's. You must then bind to each corresponding group object, using the SID value, to retrieve the name. 3. A recursive retrieval of the memberOf attribute. This method: a. Reveals membership due to group nesting. b. Reveals both security and distribution groups. c. Does not reveal the "primary" group (or any groups the "primary" is a member of). This method requires that you bind to each group object to retrieve the memberOf attribute. In addition, you must keep track of the groups in a hash table to avoid an infinite loop if the group nesting is circular. Atenciosamente, Ednaldo Dias da Silva Em sex., 29 de abr. de 2022 às 02:22, shane-oliver ***@***.***> escreveu:

…

Hi ednaldodias, Thanks for this - It fixed the issue. With your modifications using Microsoft AD a users "primaryGroupID" now is included with their "memberof" list of groups. I notice that you change the ldap_user.attrs uid > distinguishedName is that a mandatory change ? — Reply to this email directly, view it on GitHub <#267 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AB3O4AR7J7PKLMV2CX55GQDVHNWYZANCNFSM5DK2OSBQ> . You are receiving this because you modified the open/close state.Message ID: ***@***.***>