>From 9b6670e1c568ea76af0875773ab9d0e2c5982698 Mon Sep 17 00:00:00 2001 From: Jakub Hrozek Date: Thu, 28 Aug 2014 18:07:52 +0200 Subject: [PATCH 3/3] LDAP: Enable tokenGroups with Windows Server 2003 According to Microsoft documentation, the tokenGroups attribute is available since Windows 2000: http://msdn.microsoft.com/en-us/library/cc220937.aspx We were not able to test against Windows 2000, though, as we don't have that OS around, so this patch only changes the compatibility level do 2003. --- src/providers/ldap/sdap_async_initgroups.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/providers/ldap/sdap_async_initgroups.c b/src/providers/ldap/sdap_async_initgroups.c index 2eecdf9a3e9a42fdfd101132b0b856540893cee7..62e76cc4ac76fa2edf1de67c0468d2a5e99f9599 100644 --- a/src/providers/ldap/sdap_async_initgroups.c +++ b/src/providers/ldap/sdap_async_initgroups.c @@ -2907,7 +2907,7 @@ static void sdap_get_initgr_user(struct tevent_req *subreq) return; } - if (state->opts->dc_functional_level >= DS_BEHAVIOR_WIN2008 + if (state->opts->dc_functional_level >= DS_BEHAVIOR_WIN2003 && dp_opt_get_bool(state->opts->basic, SDAP_AD_USE_TOKENGROUPS)) { /* Take advantage of AD's tokenGroups mechanism to look up all * parent groups in a single request. @@ -3008,7 +3008,7 @@ static void sdap_get_initgr_done(struct tevent_req *subreq) case SDAP_SCHEMA_RFC2307BIS: case SDAP_SCHEMA_AD: - if (state->opts->dc_functional_level >= DS_BEHAVIOR_WIN2008 + if (state->opts->dc_functional_level >= DS_BEHAVIOR_WIN2003 && dp_opt_get_bool(state->opts->basic, SDAP_AD_USE_TOKENGROUPS)) { ret = sdap_ad_tokengroups_initgroups_recv(subreq); -- 1.9.3