Enable Active Directory primary groups

[mtkraai]

Include primary group relationships when searching groups by users, or users by group. Active Directory does not include this relationship in the member and memberOf collections in LDAP queries.

[ares]

@ezr-ondrej any chance you could take a look and test?

[ezr-ondrej]

Sorry for the delay! Me 👎 😞
I have tested it and I have few comments, probably based just on my poor AD knowledge. 🙂

1. Is there a performance impact anticipated? The primary-group-token is a computed attribute and the primary group walk is going to happen always. Won't that be a problem in larger instances?
2. Would you mind to explain the business case backing it? Because as I understand it, changing of primary group is not recommended. So in all ADs I have seen it would only result in adding the "Domain Users" and "Users" for group_list in most cases. And obviously list of all users by user_list on "Domain Users" is that really helpful or is there some better use case?
3. (nit) The user_list for "Domain Users" returns [] as it does not respond any method, so _groups_from_ldap_data will not be even hitted and we introduce a bit of an inconsistency as group_list('user') gives [..."Domain Users"...], but user_list('Domain Users') is not returning the user.

Otherwise it works smooth and apart those three points I generally like it. If you would please explain the business use case, I will be happy to approve 👍

[dLobatog]

@mtkraai ping?