testing group membership

[Peter Schober]

* Bennett, Steve <s.bennett at lancaster.ac.uk> [2013-04-17 13:49]:
> I think I need to store a flat copy of my group memberships in a
> database. Then it's a simple lookup for the first part, and I
> already have the second part working.

I wouldn't take that lightly, that's another piece of infrastructure
that can break, can get out of sync, needs to be maintained for the
forseeable future, etc.
(But granted recursively resolving memberships on-access in the IdP
doesn't sound too tempting either.)

Personally I'd rather have the existing group management processes
(whatver those are at your site) place also take care of
creating/maintaining flattened memberships directly in LDAP.
(Doing that may turn out to replace use of the memberOf overlay with
"statically" provisioned membership which then also include the
flattened ones.)

I suppose one should mention Grouper at this point.
-peter