Grouper Users - Open Discussion List

[Tom Zeller <>]

Yes, if you don't need member groups to be provisioned omit the  
"g:gsa" source-subject-identifier.

Locally, the rationale for provisioning member groups was for  
troubleshooting purposes and for administrators of Active Directory  
who primarily use management tools other than Grouper.

TomZ

> >
> However, I can't think of a reason why we would want to know
> about member groups from the ldap side. All of our usage is
> going to be based on knowing whether a person is in a given
> group, be it direct or indirect. Given that, could I avoid the
> extra lookups altogether if I just remove the
> <source-subject-identifier> entry for the g:gsa source? Much of
> our automatically-generated group struture relies on
> member-groups in the definitions; eliminating all those lookups
> may make a significant difference.
>
>  -paul