Mailing-List: contact users-help@directory.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@directory.apache.org
Received-SPF: pass (nike.apache.org: domain of akarasulu@gmail.com designates
 209.85.220.221 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=mime-version:in-reply-to:references:date:message-id:subject:from:to
         :content-type:content-transfer-encoding;
        b=vUD7kIVgxNd4K82PMWVjdzSTPsAnTJzcA3YRVEKvv9CsIW9vjESP4zZqaIltGVnmzC
         Cl7uMoNr69owXQfVSRlSbBq319rj0WFKyFeAiviW3kQNHxfq6bQG46jRKjvc9fssUKlS
         Jbj21EaLr43tDh6Fgym6S85mF4KSrp2Bvy4pA=
MIME-Version: 1.0
In-Reply-To: <4B99EDBD.9030603@labeo.de>
References: <4B994187.8030002@palantirtech.com> <4B99EDBD.9030603@labeo.de>
Date: Fri, 12 Mar 2010 14:17:07 +0200
Message-ID: <a32f6b021003120417h65c6f915wecb6ed9c2d9259e2@mail.gmail.com>
Subject: Re: Nested Groups and the Atlassian Crowd Connector
From: Alex Karasulu <akarasulu@gmail.com>
To: users@directory.apache.org
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

We could write a stored procedure and initerceptor to do this I think.
But it takes time and work :)

On Fri, Mar 12, 2010 at 9:31 AM, Stefan Zoerner <stefan@labeo.de> wrote:
> Hi Carl!
>
> Carl Myers wrote:
>>
>> One workaround that occured to me is: Can ApacheDS be configured to
>> automatically flatten nested groups, and always return transitive member=
s?
>
> I assume no. At least it is not easy, to accomplish this task. A director=
y
> does not know, what nested groups are. It does not know, what groups are.
> For the directory they are simply entries. Nested groups are detected by
> performing several search requests as described here:
>
> http://middleware.internet2.edu/dir/groups/internet2-mace-dir-groups-best=
-practices-200210.htm#_memberOf_Algorithm
>
> Either the Crowd code contains an error, your it has problems with your d=
ata
> (which might by an error as well). Is it possible to configure a depth fo=
r
> the searches? Strange thing, that some nested groups a resolved, some are
> not ...
>
> Anyway. From an ApacheDS point of view, it would be possible to implement=
 an
> interceptor which detects (and returns) all nested groups a user belongs =
to,
> if a specific search op is send to the server.
>
> But this would be custom application development, not a quick workaround.
>
> Greetings from Hamburg,
> =A0 =A0StefanZ
>
>


--=20
Alex Karasulu
My Blog :: http://www.jroller.com/akarasulu/
Apache Directory Server :: http://directory.apache.org
Apache MINA :: http://mina.apache.org