From: Glen Holcomb <damnbigman@...>
Date: 2007-04-20T02:31:42+09:00
Subject: Re: ruby scripting on microsoft active directory plus exchange

------=_Part_43532_5747900.1177003899530
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

On 4/19/07, Ball, Donald A Jr (Library) <donald.ball@nashville.gov> wrote:
>
> > There is an attribute called memberof which has a list of all
> > the groups the user account belongs to.  You should be able
> > to call memberof on your returned LDAP object and get an
> > array with the groups in it.
>
> That works great, thanks! A quick followup if you don't mind: if I'm
> trying to authenticate a user and see if she belongs to either of two
> groups, say, is it better to search twice against two different
> treebases and simply see if either returns a match, or search in the
> nearest common ancestor and check the memberof attribute?
>
> - donald
>
>
I would guess that the latter would be faster.  Although I have no idea how
your directory is organized or how large it is.

Francis,  your Net::XACML proposition sounds very interesting.  I would be
happy to provide what help I can.  I should forewarn you though, I'm new to
ruby and haven't done any serious programming in a while.  As for my ideas
with regards to Net::LDAP and A/D.  I will collect them and post something
later today (work has been a bit hectic).

-- 
"Hey brother christian with your high and mighty errand, Your actions speak
so loud, I can't hear a word you're saying."

-Greg Graffin (Bad Religion)

------=_Part_43532_5747900.1177003899530--