I don't know much about LDAP so I apologise in advance.
I am looking at a bug in an application that does some authentication using LDAP.
The LDAP directory structure set up by the client contains nested groups and looks like the following:
UAT Group DEV Group portfolio_mangers
Under the DEV Group we have some users:
DEV Group jsmith cwilson plo
The user requires that authentication will recursively traverse the input group to determine if the user is directly or indirectly (nested) a member of the input group.
So if we start our traversal at either the UAT Group or the DEV Group, users jsmith, cwilson and plo would be authenticated.
This is possible, correct? From my reading I believe I have to specify a base name and scope. And since I want to search an entire subtree, I would specify a scope of SUBTREE. Does this make sense? Are there alternatives?
Advice from LDAP experienced folks would be tremendous. Thanks.