Hello All,

I'm trying to create a group called Domain Users, that will include several other groups that are populated with users inside of the LDAP database. In the LDAP database, for a group entry, there are memberUid entries that can be filled. When I try to use another "Group" name, it just lists that name and not the people in that group.
So if group "A" has Jim, John, Sue, and I include group "A" in the memberUid of the Domain Users group, I want that to reference the people in that group, not the group name.
Testing access right, having the group name listed in "Domain Users" group, does not grant user access under the group rights on a directory. Should be simple, but I don't know the syntax to use for this reference.

Thanks for any advice/help!!!
Merlin53

Unless I'm missing something very significant here, ldap doesn't support this. Data in ldap is merely individual atomic pieces of arbitrary data. They don't really *mean* anything to ldap, so traversal of group membership hierarchies are not it's problem, but the ldap client which is interpreting the data into something meaningful. AD does this, which is probably why you're expecting, but AD is doing that extra layer of interpretation in it's role of being much more than just a directory. So whilst most things are perfectly possible, it's your client that needs to do that, if it can.

Bummer... I have looked through lots of documentation, and haven't seen anything that actually does referencing of other data, which is why I asked. Your assumption is correct, I was hoping to define "Domain Users" group as a sum of all the other defined groups, which I would use as a permission/owener on directories on client systems. This was an attempt to simplify administration, but looks like I will have to find another solution.

Thanks Chris!!!
Al