ldap authentication to AD works for groups except "domain users"

Question

ldap authentication to AD works for groups except "domain users" - Is this issue with whitespace? ( apache6 )

Do I need to edit this row somehow to support whitespacE?

roleSearch="(member={0})"

Answer 1

User objects aren't typically added to Domain Users. It's usually marked as their primary group in the user object. I would avoid using membership in Domain Users for role-based security as it will complicate any role provider that you need to write. For most purposes, membership in Domain Users simply means that you have an account in the domain. This can easily be checked by doing a lookup on the user object itself. I've only had one situation in which I've used Domain Users -- this was in a Windows login access solution -- and that was as a fallback to keep using our group-based access when the original group management scheme broke down for political reasons.