I've seen similar questions related to configuring Apache to authenticate via LDAP, but this basic question still has me confused.
In my setup, I created users who all have the same primary GID, then I added users to various (supplementary/secondary) groups. I have tested these user accounts, and in most situations everything works fine - my permissions based on supplementary group membership is working. I used the
smbldap-tools package to configure my users and groups, and specifically I used
smbldap-usermod -G +NEW_GROUP user to add users to the supplementary groups.
If I do
getent group I see those supplementary groups and their members. Good.
If I look at the LDAP entry for one of the supplementary groups, I see all the users listed just as expected.
However, when I look at each user's LDAP entry, only a
gidNumber corresponding to the primary group is listed. That is, the LDAP entries for each user only list the primary group, and have no mention of secondary groups.
How does Samba/LDAP (using smbldap-tools) handle supplementary/secondary groups?
Further, how could I form a search filter to identify members of a supplementary group?