Rework get_nested_group_members to be check_if_nested_group_member

[mprahl]

"get_nested_group_members" should be changed to something like "check_if_nested_group_member", so that the entire group membership isn't returned for performance reasons.

[thatarchguy]

Can't you just query the user memberOf's and compare against a supplied group name?

That may be more efficient and fit the function call flow better.

query_filter = "(&(member:1.2.840.113556.1.4.1941:=CN= \
            {0},{1}))".format(
                repr(full_name).strip("'"), base_dn)

 search_result = ad_object.ldap_connection.search_s(base_dn, ldap.SCOPE_SUBTREE, query_filter, ['memberOf'])

then something like if group_name in search_result

[mprahl]

@thatarchguy you can't use memberOf because it doesn't contain nested group membership. So for instance, if the admin group is called "PostMaster Admins" and the user is a member of the group "Mail Admins", which is a member of "PostMaster Admins", the query would not function correctly.

Your other point though of using "member:1.2.840.113556.1.4.1941" on the user may be more efficient. I suppose it depends on how many nested groups the user is a part of, versus the number of users in the admin group. The efficiency would vary per environment, but I think generally that you are right, more often than not, it'd be more efficient to check the user's group membership versus the members in the specified group.