Indirect/nested group membership behaviour change in 4.6.8

[Mark Stewart]

All,  We have a RHEL estate currently at Red Hat release 4.9 This included an IPA upgrade to 4.6.8. As soon as the upgrade was complete the various applications that we have integrated with FreeIPA/IdM ceased to recognise nested group membership. We opened a case with Red Hat who reported that nothing had changed that would cause that behaviour. I'm just checking if anyone is aware of what may have changed in this IPA release, or part of the configuration that we should verify?

Thanks.

[Rob Crittenden]

Mark Stewart via FreeIPA-users wrote:
> All,  We have a RHEL estate currently at Red Hat release 4.9 This included an IPA upgrade to 4.6.8. As soon as the upgrade was complete the various applications that we have integrated with FreeIPA/IdM ceased to recognise nested group membership. We opened a case with Red Hat who reported that nothing had changed that would cause that behaviour. I'm just checking if anyone is aware of what may have changed in this IPA release, or part of the configuration that we should verify?

I think we need more details on what you're seeing. What subtree you're
apps are searching on, what results they are getting and expecting, etc.

rob