AD Query String for Group Membership

Hi
I have found that inbound mail to distributions groups (Ex07) are not being delivered. Running a trace, I am seeing they are failing on LDAP match. I tracked it down to the qroup query not working. We are using the default query. Running a test, it fails. I think that is the problem. I can mail the group internally just fine.
Anyone have a good query string that will check for distribution groups? Below is the query being used. Thanks for the help.
(&(memberOf={g})(proxyAddresses=smtp:{a}))

Can you go to the LDAP section and provide all the fields that are relevant?
I'll need the LDAP configuration fields (minus the password of course) and what you're using for the LDAP Accept.
Well I opened a ticket with support, and it appears that I have them stumped. From what they tell me it isn't the ldap group query that is failing, but rather the ldap accept query failing.
Sending to the group does work internally so It looks like ldap is good with the the proxy address, but ironport is failing on the query.
Snippit from trace:
Envelope Recipient Processing
Envelope Recipient: [email protected]
LDAP Accept Lookup: Result: failed
Default Domain Processing: No Change
Domain Map Processing: No Change
Recipient Access Table Processing: Behavior: ACCEPT Matched On: [email protected]
Alias Expansion: No Change

Similar Messages

Publishing server doesn't work - error 'The request URL doesn't contain the query string for the client OS'

Hi,
I'm trying to setup an App-V environment in my lab.
I've used the App-V 5.0 Trial guide to help me configure all necessary components.
I'm able to install everything without error.
when come time to publish an app, it simply doesn't show up on my client.
after looking at events on the client and server, I found that the Publishing server is returning under Admin the following message.
'The request URL doesn't contain the query string for the client OS'
My setup is pretty simple.
App-V Server managament and Publishing on the same box
App-V database on my SQL server.
I'm able to see the publishing "webpage" by using http:://localhost:889.
It only display this :
-<Publishing Protocol="1.0"
<Packages />
</Publishing>
I've published one app from the management console.
any idea what could mean this error?
thanks

Hi,
thanks for the link.
I've validated the suggested debug steps. It seems that the problem is with my Publish server again.
I've looked in the web.config file. It seems to be missing some parts compare to the example provided.
Again, I've published an application from the management console. Management and Publishing are running on the same box, while SQL is remote.
Here's the web.config
<?xml version="1.0" ?>
- <configuration>
- <system.web>
<compilation debug="false" targetFramework="4.0" />
<machineKey validationKey="AutoGenerate,IsolateApps" decryptionKey="AutoGenerate,IsolateApps" />
- <authentication>
- 
<forms requireSSL="true" />
</authentication>
</system.web>
- <system.webServer>
- <modules runAllManagedModulesForAllRequests="true">
<add name="UrlRoutingModule" type="System.Web.Routing.UrlRoutingModule, System.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />
</modules>
- <security>
- <requestFiltering>
- <verbs>
<remove verb="GET" />
<add verb="GET" allowed="true" />
</verbs>
</requestFiltering>
</security>
</system.webServer>
- <system.serviceModel>
<serviceHostingEnvironment aspNetCompatibilityEnabled="true" multipleSiteBindingsEnabled="true" />
+ <behaviors>
- <serviceBehaviors>
- <behavior name="">
<serviceAuthorization impersonateCallerForAllOperations="true" />
<serviceMetadata httpGetEnabled="false" httpsGetEnabled="false" />
</behavior>
</serviceBehaviors>
</behaviors>
- <bindings>
- <webHttpBinding>
- <binding name="SecureBinding">
- <security mode="Transport">
<transport clientCredentialType="Windows" />
</security>
</binding>
<binding name="UnsecureBinding" />
</webHttpBinding>
</bindings>
- <protocolMapping>
<add scheme="http" binding="webHttpBinding" bindingConfiguration="UnsecureBinding" />
<add scheme="https" binding="webHttpBinding" bindingConfiguration="SecureBinding" />
</protocolMapping>
- <standardEndpoints>
- <webHttpEndpoint>
- 
<standardEndpoint name="" helpEnabled="true" automaticFormatSelectionEnabled="true" />
</webHttpEndpoint>
</standardEndpoints>
</system.serviceModel>
</configuration>

Bhold attestation setup if FIM POrtal is already used for Group Membership

Background - We had a FIM 2010 deployment in production deployment. Few
months ago, we upgraded it to FIM R2. There are already about 4000 Criteria based Groups and Request Based Groups at FIM portal. FIM portal is used as an authoritative source for group membership.
Problem Statement - The requirement is to attest the existing and
ongoing Request Based group membership of users using BHold User Attestation module. We want to continue FIM portal (not Bhold UI) as the end user interface for requesting the group membership.
Hence, for metaverse' group object's member attribute, FIM Portal should have higher precedence than Bhold MA.
From available documentation of Bhold, I understand that BHold is more suitable in cases where FIM Portal is not already the Group Membership deciding system. However, in our already existing
deployment, both group membership is given by FIM portal. In fact this should be the case with all the FIM deployments before Bhold’ s release.
Please suggest on how to attest the group memberships.
Mayank Vaish

I would not expect to have to attest group membership where that membership is controlled programmatically. The idea of Attestation is for a responsible person to attest and confirm that the membership of a given group/role/permission is correct (and remove
users who don't need that permission). As long as someone responsible has attested that the rules that govern the automatic group membership are appropriate for the permission controlled by that group, then another round of attestation via BHOLD would seem
like overkill.
However, in the case where membership of FIM groups is managed via FIM's approval mechanism then there may well be a case for BHOLD attestation. It will depend on the business's audit requirements and how well the FIM logs are being maintained, and
also the sensitivity/importance of the permission being managed by the group. If it is not possible to prove who approved membership of what group - and to confirm that that membership is still appropriate - then regular attestation may still be required,
in which case BHOLD is an easier way of doing it than trying to build your own or do it manually.
Cheers,
Dave

SQL syntax for querying Active Directory group membership

Post Author: cantrejj
CA Forum: Data Connectivity and SQL
I've established a connection to Active Directory through Crystal Reports XI. Now I need to write an SQL select statement to return all computer accounts and their group memberships. My statement returns all the computer accounts in the target OU, but when I add the memberOf field to my report everything goes blank. What am I doing wrong? I've included below my query statement and would welcome any suggestions...******************************************Select CN, memberOfFrom 'LDAP://OU=Managed Accounts, OU=Central Valley Service Area, DC= root, DC=sutterhealth, DC=org'where ObjectClass='computer'********************************************

No ERRORs, no PANICs:
# grep -i error /var/log/samba/log.smbd
# grep -i panic /var/log/samba/log.smbd
# grep -i error /var/log/samba/log.smbd.old
# grep -i panic /var/log/samba/log.smbd.old
#

Maximum length of query string for functions return a SELECT

Hi all,
I have a report that gets it's SELECT statement from a function, instead of being coded into the region. All was well but I suspect now I'm blowing some kind of limit as I'm getting an error :
ORA-06502: PL/SQL: numeric or value error
Error ERR-1101 Unable to process function body returning query.
However if I run the procedure out of ApEx and grab the SELECT statement then it works fine. The length of the query is 8636 bytes (yup, it's a beauty!).
Does anyone know if there is a hard limit to the size of the string that can be returned?
I'm using ApEx 3.1.
Thanks,
Steve H

I do have a similar painfull scenario - Although my query length is very less i.e 618 bytes only.
I have defined a stored function, which returns an SQL query string, this return SQL string executes fantastic but when I tried to to call this function from a APEX report it gives error. the details are as follows. Please help.......
The function code:
CREATE OR REPLACE function PROD."TEST_C_QRY"
return VARCHAR2
is
msql VARCHAR2(32767);
Begin
msql:='Select null,statusname,AgeInd, ';
For m_stat in (select statusname from a02_status)
loop
msql:= msql || q'[decode(statusname,']';
msql:= msql || m_stat.statusname;
msql:= msql || q'[',count(id),0) ]';
msql:= msql || m_stat.statusname|| ',';
end loop;
msql:=rtrim(msql,',');
msql:= msql||' from ';
msql:= msql||'( ';
msql:= msql||'select a.id, round(sysdate-a.registeredon) TimeSpan,';
msql:= msql||'case ';
msql:= msql||q'[when round(sysdate-a.registeredon)<=7 then 'Week' ]';
msql:= msql||q'[when round(sysdate-a.registeredon)>7 and round(sysdate-a.registeredon)<14 then 'Fortnight' ]';
msql:= msql||q'[when round(sysdate-a.registeredon)>14 and round(sysdate-a.registeredon)<30 then 'Month' ]';
msql:= msql||q'[else 'More...' end ageind,]';
msql:= msql||'a.status_id,b.statusname ';
msql:= msql||'from a02_task a,a02_status b ';
msql:= msql||'where b.id=a.status_id) ';
msql:= msql||'group by statusname,AgeInd;';
return msql;
end TEST_C_QRY;
The Output SQL comes from this is
SQL> Select null,statusname,AgeInd, decode(statusname,'Scheduled',count(id),0) Scheduled,decode(statusname,'Executing',count(id),0) Executing,decode(statusname,
'Completed',count(id),0) Completed from ( select a.id, round(sysdate-a.registeredon) TimeSpan, case when round(sysdate-a.registeredon)<=7 then 'Week' when round
(sysdate-a.registeredon)>7 and round(sysdate-a.registeredon)<14 then 'Fortnight' when round(sysdate-a.registeredon)>14 and round(sysdate-a.registeredon)<30 then
'Month' else 'More...' end ageind, a.status_id,b.statusname from a02_task a,a02_status b where b.id=a.status_id) group by statusname,AgeInd;
The result that comes when I execute the above resultant SQL is as follows.
N STATUSNAME AGEIND SCHEDULED EXECUTING COMPLETED
Completed More... 0 0 4
Completed Week 0 0 1
Scheduled Week 1 0 0
Completed Month 0 0 3
Executing More... 0 1 0
Executing Month 0 6 0
Scheduled More... 1 0 0
7 rows selected.
But the surprising error that comes from Oracle XE when I use the following code for stacked bar chart
Code:
begin
return TEST_D_QRY;
end;
Error thrown by XE report builder is as follows:
1 error has occurred
Failed to parse SQL query!
Select null,statusname,AgeInd, decode(statusname,'Scheduled',count(id),0) Scheduled,decode(statusname,'Executing',count(id),0) Executing,decode(statusname,'Completed',count(id),0) Completed from ( select a.id, round(sysdate-a.registeredon) TimeSpan, case when round(sysdate-a.registeredon)<=7 then 'Week' when round(sysdate-a.registeredon)>7 and round(sysdate-a.registeredon)<14 then 'Fortnight' when round(sysdate-a.registeredon)>14 and round(sysdate-a.registeredon)<30 then 'Month' else 'More...' end ageind, a.status_id,b.statusname from a02_task a,a02_status b where b.id=a.status_id) group by statusname,AgeInd;
Certain queries can only be executed when running your application, if your query appears syntactically correct, you can save your query without validation (see options below query source).
Regards,
Soumen

Child form for Group Membership OID -OIM 11g

Hi,
Can we configure a custom child form to store OID group membership in OIM 11g? If Yes, what are the configuration changes to be considered.
Thanks in advance

Hi,
Can we configure a custom child form to store OID group membership in OIM 11g? If Yes, what are the configuration changes to be considered.
Thanks in advance

Query output for group by

Hi !
Can someone help ?
What I am looking for is, those days in the first query which do not return any rows should be displayed with a 0. I have all the days available in that table. Ie. 13/14/15th it should display as 0 instead of skipping it
SQL> select trunc(logtimestamp),count(*)
from SOACOE_LOGGER_SUMMARY
where
 ERRORTYPE is not null
group by trunc(logtimestamp)
order by trunc(logtimestamp); 2 3 4 5 6
TRUNC(LOGTI COUNT(*)
05-MAR-2009 2
06-MAR-2009 13
07-MAR-2009 6
08-MAR-2009 1
09-MAR-2009 3
10-MAR-2009 3
12-MAR-2009 1
17-MAR-2009 36
18-MAR-2009 28
9 rows selected.
SQL> select distinct trunc(logtimestamp)
from SOACOE_LOGGER_SUMMARY
order by trunc(logtimestamp); 2 3
TRUNC(LOGTI
05-MAR-2009
06-MAR-2009
07-MAR-2009
08-MAR-2009
09-MAR-2009
10-MAR-2009
11-MAR-2009
12-MAR-2009
13-MAR-2009
14-MAR-2009
15-MAR-2009
TRUNC(LOGTI
16-MAR-2009
17-MAR-2009
18-MAR-2009
19-MAR-2009
15 rows selected.Thanks
G

SQL> WITH soacoe_logger_summary AS
2 (
3 SELECT DATE '2009-3-5' AS logtimestamp, 1 AS errortype
4 FROM DUAL
5 UNION ALL
6 SELECT DATE '2009-3-6', 1
7 FROM DUAL
8 UNION ALL
9 SELECT DATE '2009-3-7', 1
10 FROM DUAL
11 UNION ALL
12 SELECT DATE '2009-3-8', 1
13 FROM DUAL
14 UNION ALL
15 SELECT DATE '2009-3-9', 1
16 FROM DUAL
17 UNION ALL
18 SELECT DATE '2009-3-10', 1
19 FROM DUAL
20 UNION ALL
21 SELECT DATE '2009-3-12', 1
22 FROM DUAL
23 UNION ALL
24 SELECT DATE '2009-3-17', 1
25 FROM DUAL
26 UNION ALL
27 SELECT DATE '2009-3-18', 1
28 FROM DUAL)
29 SELECT d, COUNT(logtimestamp)
30 FROM soacoe_logger_summary,
31 (SELECT mindate + LEVEL - 1 AS d
32 FROM (SELECT MIN(logtimestamp) AS mindate, MAX(logtimestamp) AS maxdate
33 FROM soacoe_logger_summary)
34 CONNECT BY LEVEL <= maxdate - mindate + 1)
35 WHERE ERRORTYPE(+) IS NOT NULL AND d = TRUNC(logtimestamp(+))
36 GROUP BY d
37 ORDER BY d;
D COUNT(LOGTIMESTAMP)
05.03.09 1
06.03.09 1
07.03.09 1
08.03.09 1
09.03.09 1
10.03.09 1
11.03.09 0
12.03.09 1
13.03.09 0
14.03.09 0
15.03.09 0
16.03.09 0
17.03.09 1
18.03.09 1

FF change single quotes in query string for their url-encode form (%27) and I need use single quotes (I don't care about derivated security problems)

When I try to enter a url like:
www.example.com?owner=alex's
the actual URL the FF send is:
www.example.com?owner=alex%27s
I need the first option and I don't know hoy to configure it. Could you help me?

I think that RFC1738 is outdated and you should look at RFC3986 section 2.2: 
"URI producing applications should percent-encode data octets that correspond to characters in the reserved set unless these characters are specifically allowed by the URI scheme to represent data in that component. If a reserved character is found in a URI component and no delimiting role is known for that character, then it must be interpreted as representing the data octet corresponding to that character's encoding in US-ASCII". 
I think that in this case there is no special delimiting role or "reserved purpose" for the character to allow the unencoded use. So I think that the behaviour of Firefox is correct. 
http://www.rfc-editor.org/rfc/rfc3986.txt

AD account used for running SIA locked during group membership querying

Hello,
I have code that is querying user / group membership from the BOE repository using the Java Enterprise SDK. When running against an environment using an AD service account to run the SIA, an error is thrown and the AD account is subsequently locked when I execute my code. The error is as follows:
com.crystaldecisions.sdk.exception.SDKServerException: The Active Directory Authentication plugin failed to verify the currently specified administration credentials required to connect to Active Directory. Please contact your system administrator.
cause:com.crystaldecisions.enterprise.ocaframework.idl.OCA.oca_abuse: IDL:img.seagatesoftware.com/OCA/oca_abuse:3.2
detail:The Active Directory Authentication plugin failed to verify the currently specified administration credentials required to connect to Active Directory. Please contact your system administrator.
The server supplied the following details: OCA_Abuse exception 10505 at [.\exceptionmapper.cpp : 79] 50068 { , , secWinAD}
...The Active Directory Authentication plugin failed to verify the currently specified administration credentials required to connect to Active Directory. Please contact your system administrator. Plugin error: SecWinAD Error: an error occurred in CADCredentialManager::SwitchSecurityContexts().
If the account is successfully running the SIA, I'm not understanding why this message is being thrown. Also - I'm assuming some internal login is happening with this AD account when I query for group membership (?), as I am able to query for other types of metadata without error / locking the account. Based on the error thrown, the authentication with this ID is failing, and is probably being attempted multiple times, resulting in the account being locked? Can anyone provide insight here?
Thanks...

Ted is right on the mark with this one.
The cause is outlined in the exception indicating a problem with the SwitchSecurityContexts() function. The Active Directory plugin requires a set of credentials with which to connect to Active Directory and perform any necessary lookups. Therefore, the issue is not with the account running your SIA (and by extension your CMS), but the Active Directory administration credentials you've set on the plugin (either via the CMC or through code). When the CMS tries to impersonate, or switch security context to the other account, it fails to authenticate against Active Directory.
Check to make sure this property is set identically to the account running the SIA, and like Ted said, that you can successfully update the plugin via the CMC.
Thanks,
Jim

Group Memberships not Flowing into Metaverse

Hello,
I'm trying to figure out why the group member attributes in the CS are not flowing into the MV. Here's what I have:
An HR system running on SQL Server
A staging database that extract data from the HR system
The staging database has a table representing person object
The stating database has a table representing person multi-valued attributes (i.e location, job code, etc)
The staging database has a table representing group objects
The staging database has a table representing group memberships (mult-valued)
A SQLMA connected to the person and person multi tables
A SQLMA connected to the group and group membership tables
All group memberships are based on job codes and locations. There are no approval process in place. If they have this job code, they get certain groups. That's all calculated in the staging database and the memberships are in the group membership
table
This system does connect to AD (and a few other things), but I'm not concerned with that, right now.
I've read 100 articles on this, most of them over 5 years old, and tried the ones that made sense. The flow from the database into the CS works well. No issues there.
But, a search of the metaverse for the group shows an empty member attribute. The sync process is not throwing any errors. At least they're not showing up in the sync service app or the event logs.
Where allowed, I'm using rules extensions for everything. I can't use a rules extension to set the member attribute because it's an rdn.
I'm going to move forward with this by extending the metaverse schema and adding a multi-valued string attribute named "memberOf" to the person object. Then, I'll modify my existing MA to use that attribute instead of the member attribute.
I'm not sure what kind of issues I'm going to run into when exporting that to AD. I'll cross that bridge when I come to it. I don't anticipate that being an issue as the dns for all these objects will be calculated by the ADMA based on locations,
group functions and person types (bascially, I don't care about the MV rdn).
Anyway, I'm looking for some real world insight on this. This whole effort is to migrate off an existing IDM system that works very, very well but quite expensive to license.
Thanks,
Greg Wilkerson

Hey Cameron,
I have total control of all the DB tables FIM is accessing. I build them up as part of IDM process.
I've read this article, along the many others that address the "manager" scenario. This really doesn't apply in this case as the user and group objects are loaded in separate MAs. Getting reference values to flow with both object live in the
same CS shouldn't be an issue.
I also saw a solution where the group and user objects were in the same table and differentiated by the "object_type" value (user, group). That solution solved the issue of the groups and user being in the same CS. As I grow tired of my daily
FIM beatdown, that solution is growing more attractive. That's a major DB redesign, and seems quite inefficient.
The multi-value table for group memberships already exists in the DB. For FIM purposes, I transferred that data into the user object multi-value table. See screen shot. I can certainly configure the group MA to access that multi-value table
and load the group members as references. But, because the group MA CS will not contain the user objects, I don't see how the references will be set. If the reference value isn't set in the CS, it's not going to flow into the MV (at least I haven't
figured out a way to set the an reference value for an object in the MV - my problem all along.
This whole "setting a reference value" encompasses much more than just group memberships in my implementation. Telephone resources and physical access (key cards, etc) are provisioned through the existing eDirectory system. These objects exist
in our current IDM system and are associated with users based on rules. So, the reference value process is something I need to figure out, if I'm going to use this product.
Maybe I could use a stripped down ECMA2 as a "staging" CS, export the users and groups into this CS and assign the reference values, then import the groups back into the MV, memberships intact. I'm not sure that would get me where I want to go, and
it seems like a lot of extra "stuff" to solve what should be a simple problem. Hmmmmmm. Or, connect the ECMA2 directly to my group membership multi-value table in the DB. Hmmmmmm. I'd still have to export the groups and users into that
CS, but the import might be much more straight forward. Hmmmmmm.
The structure of my GroupMembership table (both columns are anchors or directly translatable to anchors):
EmployeeGroups
   GroupName varchar(50) not null,
   EmployeeID nvarchar(50) not null,
   ID int identity(1,1) not null

How to verify user LDAP group membership

Hi,
we are attempting to determine if a user is a member of a specific LDAP group in our directory and if the user is a member it should return TRUE else FALSE (this is done by defining the LDAP attribute 'CN' (property) which returns a result 'CN=<UserName> or returns 'getting 0 entries'. The query we have is
(&(cn=<username>)(memberOf=CN=<groupname>,DC=domain,DC=com)).
Any pointers on how to do this ?
Thank you.

You could do a couple of things...
1) Install dsquery (add remote AD tools to your box) and run something like
dsquery group -u <user name>
Username would be their login name, yours is "swaupadh" for example. This would return a listing of all the groups they are in and you could regex through that output for the group you are looking for. Use either the Execute Powershell or Execute Windows Command activity here.
2) Use powershell functions and powershell capability to check for group membership, something like this:
function Get-GroupMembership($DN,$group){
$objEntry = [adsi]("LDAP://"+$DN)
$objEntry.memberOf | where { $_ -match $group}
//EXAMPLE CALL
Get-GroupMembership "Cn=kazun,dc=contoso,dc=com" "Backup Operators"
Then you can regex through the output for the "True" or "False" word and run with that.
Either should get you what you want.

In JDBC Sender Adapter , the server is Microsoft SQL .I need to pass current date as the input column while Executing stored procedure, which will get me 10 Output Columns. Kindly suggest me the SQL Query String

In JDBC Sender Adapter , the server is Microsoft SQL .I need to pass current date as the input column while Executing stored procedure, which will get me 10 Output Columns. Kindly suggest me the SQL Query String , for executing the Stored Procedure with Current date as the input .

Hi Srinath,
The below blog might be useful
http://scn.sap.com/community/pi-and-soa-middleware/blog/2013/03/06/executing-stored-procedure-from-sender-adapter-in-sap-pi-71
PI/XI: Sender JDBC adapter for Oracle stored procedures in 5 days
regards,
Harish

Having problems creating PDF from website with query-string URLs

I have a website that I would like to create a PDF from. I am using the Create -> PDF from Web Page..., selecting the site's home page, and capturing 2 levels, with "stay on same path" and "stay on same server" checked in order to limit the scope of the crawl.
Where the pages are at example.com/foo/ and example.com/foo/bar/, this works fine. However, where the pages are at example.com/foo/ and example.com/foo/?p=1, the page represented by the query string URL is not converted to the PDF.
This is a problem, given that the site I want to archive as a PDF uses query strings for most of its pages.
I have been able to individually convert a single query-string-based page into a PDF using this method, but doing this for every page on the site would be almost impossible given the sheer number of pages on the site.
Is this a known issue? Is there a workaround other than separately capturing each page (which would be prohibitive effort)?
I have tried this in both Acrobat Pro X and Acrobat Pro 9 for Mac, with the same results.

Remember, Acrobat is a 32-bit application and as such cannot access all that 'extra' stuff.
Be well...

Query string error in JSP

Hi. I originally thought my problem was a javaScript problem but now realize it is a JSP problem:
I have a JSP calling another JSP (which is opened in a smaller window with javaScript) and it uses a query string for values. One of these variables in the string is a note the user enters and can contain anything. Problem is when they enter text with the '&' symbol, I'm getting a Null Pointer Execption as the receiving JSP interprets it as part of the query string.
How can I 'hide' these characters so the receiving JSP page doesn't try to process it?
Thanks in advance,
Mike

hi,
you could detect the string before you sent the string, check for the & symbol and replace it with something else, such as the html equivalent and then append it to the url and send it, on the other end read it and replace the symbol with the & to get it back without confusing the code. you would run into the same problems if the user enter = or possibly ? into the string, so try fixing it with a search and replace method.

OIM Group membership rules

Hi Friends,
I want to create groups in oim on the basis of complex rules(It requires some Java coding) but for attaching group membership rule we use Rule Designer and in rule designer we can't user adapter that means no java code.
What is the solution for this problem?
One solution could be create entity adapter for group membership and execute it on pre-update.
Thanks
Edited by: user10968321 on Oct 28, 2009 7:06 AM

The entity adapter on the user form in pre or post update mode is the standard way to solve complex membership rules.
Works well as long as you can accept a slight performance decrease on user updates (including things like password resets). Make sure your code is decently fast.
Good luck
/Martin

AD Query String for Group Membership

Similar Messages

Maybe you are looking for