Return
-
Title
Has expand ac groups functionality changed between vas3 and qas4? -
Description
Has expand ac groups functionality changed between vas3 and qas4?
-
Resolution
Yes the code has changed from 3.x to 4.x. In 3.x, we did one-level unroll of the groups to cross the forest boundary. We then added the cross forest groups with the domain lower to separate them. That way when a user's tokenGroups was processed, that only had in-domain groups, it would still find an AC match and work.
But now in 4.x, expand-ac-groups does a FULL unrolling, so that is no longer needed.