Zurück
-
Titel
How to: Show indirect members automatically on Dynamic Groups -
Beschreibung
Can Dynamic Groups show indirect members by default instead having to enable checkbox "Show indirect members":
-
Lösung
1. Create Custom LDAP search filter to include nested group members as direct members of the Dynamic group
2. Add a custom Ldap (memberof:1.2.840.113556.1.4.1941:=CN=Groups,DC=domain,DC=local)
3. Now Members tab of the Dynamic group shows both direct and indirect members without clicking Show Indirect Members.
Note: Dynamic Groups which leverage the LDAP_MATCHING_RULE_IN_CHAIN OID are quite expensive, computation-wise, and an unfiltered query that leverages this OID might lead to high CPU utilization on the target Active Directory Domain Controller. Wherever possible, a filtered LDAP_MATCHING_RULE_IN_CHAIN query should be used.
For example:(&(objectclass=group)(&(|(cn=xyz_)(cn=aws-)(cn=abc_*))(member:1.2.840.113556.1.4.1941:={1})))
This would be a query looking only for the groups where the CN starts with xyz_ or aws- or abc_
A list of more examples can be found in this link -
Weitere Informationen
For further information about LDAP_MATCHING_RULE_IN_CHAIN check out the links below.