Description of problem:
Version-Release number of selected component (if applicable):
Steps to Reproduce:
Have such AD setup:
AD1 (GC) <-> AD2 (GC)
user1 group1 (security domain local group)
Assign user1 as member of group1 and add group1 to oVirt with some permissions and login.
User is not authorized to perform this action.
Current implementation don't resolve domain local groups which are in different domain.
After first look I think the problem is that domain local group members are not located in GC, that means
we can't use whatever gc we want in order to resolve groups, but GC where domain local group resides.
Targeting to 4.1, when patch is merged we can discuss backporting to 4.0.z or even 3.6.z
Included in ovirt-engine-extension-aaa-ldap-1.3.0
include = <ad-recursive.properties>