LDAP Authorization: Nested group recognition for authorization in group strategy IIB and IIC

I'm open to a patch for 7.x-1.x if someone can articulate the ldap user attributes to write a simpletest for this.

Just a thought; I believe recursion needs to be performed BEFORE any group-to-role filtering happens, since at least in our usage of Drupal, a user might be in the "DrSmithStudent" Active Directory group, which is in the "AllStudentWorkers" group, which is mapped to a Drupal role. So even filtered-out groups need to be considered when recursing -- at least in our usage.

We figured out a good way to implement this for one ldap impementation type at a time. We are working on Active Directory currently. See [#comment-5103276]

If you have another ldap implementation and want to write the code to support nested groups, post to this thread.

That link should be: http://drupal.org/node/1115704#comment-5103276.

The shell of this is already written.

For the 7.1 release I'm going to implement Active Directory and a generic ldap, probably open ldap. Open ldap logic may belong in the abstract class "LdapTypeAbstract.class,php". I will also implement a custom extension module for the university I work at as a proof of concept to extending the server class for local customization.

Implementation Steps:

1. Implement getNestedGroupMemberships() method in AD and open ldap classes.
2. Add UI checkboxes for nested groups. Should use ajax to validation to not allow nested groups on ldap types without getNestedGroupMemberships() implemented.
3. in function _ldap_authorization_ldap_authorization_maps_alter(), nested groups should be called for each result authorization id from each of 3 derivation methods with derivation method as an argument. in some ldaps, nested groups may not be relevant in some of the methods.

Test Coverage:
Should be integrated into the current ldap authorization tests, with additional nested mock groups and nested checks turned on and off.

Made some progress on this for groups method IIB (groups are in user's ldap attributes). Here's the pseudo code:

given:
- user ldap entry ($user_ldap_entry)
- attribute containing groups (e.g. memberOf), configurable
- objectype of group (e.g. group), configurable
- list of base dns (e.g. OU=Education,DC=ad,DC=uiuc,DC=edu, OU=Campus Accounts,DC=ad,DC=uiuc,DC=edu)

(1) Add all $user_ldap_entry memberOf attribute values to $authorizations

(2) query 1: get entries of all groups that have memberOf values (all groups that have parents)

(3) Loop through resulting entries of query and add all memberOf attributes to $authorizations (that were not already in $authorizations).
(4) Construct a query like #2 with parent groups and add memberOf attributes
(5) ...and so on as long as limit of 10 is not hit and new authorizations are being added. This involves 1 query for each level of nesting instead of once query for each ancestor-descendant relationship. This may be problematic if someone is in more than 1000 groups, but could be done in batches of 100 or so also.

At my university, I get 219 groups with 4 levels of queries (8 queries for 2 basedns). If you use N basedns the number of queries multiplies by n so I'm going to start just using one higher basedn: this has the advantage of not running into barriers when querying for groups outside of your basedns.

I'll commit this code after I do the nested groups for case IIC, but I wanted to get feedback on the approach. I also was wondering if the following were well known for ldap implementations:

- configurable attribute containing groups (e.g. memberOf),
- configurable objectype of group (e.g. group)

Novell's eDirectory:
- member or groupMember ?
- groupOfNames

Active Directory:
- memberOf
- group

Oracle and Netscape:
(http://docs.oracle.com/cd/E22289_01/html/821-1273/defining-groups.html#d...)
- uniquemember
- groupOfUniqueNames

Open LDAP:
- ?

The UI and code for strategy IIB and IIC nested groups is in 7.x-1.x-dev. Can those of you using this, look through the following and see if it makes sense for your LDAP implementations:

Overview of how it is implemented in IIC is at:
http://drupalcode.org/project/ldap.git/blob_plain/refs/heads/7.x-1.x:/ld...

And unit tests for how it is implemented in IIB are at:
http://drupalcode.org/project/ldap.git/tree/refs/heads/7.x-1.x:/ldap_aut...