Hi there,
I found this interesting %{ldap_multi:...} construct.
So something like this should yield a usable acl-group config from LDAP:
userdb { ... fields { acl_groups = %{ldap_multi:employeeType|list|default('people')} } }
provided that employeeType in this example is (mis-)used to store group membership.
If I think about the usual LDAP group, however, it is rather that an LDAP group-membership is recorded as, e.g., a memberOf attribute with a dn as value like memberOf=cn=groupname,ou=Groups,dc=example,dc=de.
Are there further filter-constructs which could extract the first component of such a dn? If I understood correctly the ldap_multi "extractor" would yield
cn=GROUP1,ou=Groups,...TABcn=GROUP2,ou=Groups,...
and "list" converts tabs to a comma. But this would not yield the desired result here which would be the list GROUP1,GROUP2.
I am aware of post-login hooks to accomplish acl-group collection. I was just curious if other possibilities are already builtin after I stumbled over ldap_multi.
Thanks for any comments
Claus
-- Claus-Justus Heine himself@claus-justus-heine.de http://www.claus-justus-heine.de/
Schatzmeister der Camerata Academica Freiburg e.V. --- www.cafev.de