On Fri, 18 Sep 2015, Ondrej Valousek wrote:
Hi List,
Man sssd-ldap says:
"
If ldap_group_nesting_level is set to 0 then no nested groups are processed
at all. However, when connected to Active-Directory Server 2008 and later it
is furthermore required to disable usage of Token-Groups by setting
ldap_use_tokengroups to false.
"
Why is usage of tokengroups not possible with Windows server 2008 or newer?
Can someone clarify?
That's not what it means. If you have tokengroups enabled, you get fully
nested group handling as a result.
If you want to disable nested group handling, you have do disable both
tokengroups and set ldap_group_nesting_level to 0.
jh