ldap - Sitecore Active Directory Indirect Membership -

we have sitecore 6.5 ad module 1.0.4.

users in ad group department\sitecoreusers can login sitecore, users in department\sitecore_role1 group cannot login though department\sitecore_role1 group member of sitecore_users.

the ldap.includeindirectmembership set true , groups have membership in domain\sitecoreusers show in role manager. have tried adding sitecore_role1 role member of sitecore\sitecore client users, still did not allow sitecore_role1 members login.

do of our ad users have added both sitecore_role group , sitecore_users group? thought belonging member groups should allow them login sitecore. can please set me straight?

i have worked though sitecore ad module admin guide , think have set correctly, here think relevant settings review.

the connection string being used is:

<add name="wudosisconnectionstring" connectionstring="ldap://wudosis.wustl.edu:389/dc=department,dc=ourorg,dc=edu"/>

and our ad set

- department     + groups         * sitecore             - sitecore_users             - sitecore_role1 (member of sitecore_users)             - sitecore_role2 (member of sitecore_users) 

the items in system.web/membership/prividers, rolemanager, , profile have customfilter = (memberof=cn=sitecore_users,ou=sitecore,ou=groups,dc=department,dc=ourorg,dc=edu)

the correct syntax getting descendent members of ad group is:

(memberof:1.2.840.113556.1.4.1941:=cn=sitecore_users,ou=sitecore,ou=groups,   dc=department,dc=ourorg,dc=edu) 

if want include group in result along members , members of member-groups, use:

(|(&(objectcategory=group)(cn=sitecore_users))   (memberof:1.2.840.113556.1.4.1941:=cn=sitecore_users,ou=sitecore,ou=groups,   dc=department,dc=ourorg,dc=edu)) 

note & value replaces normal ampersand because line included in site's web.config , ampersands not valid xml characters.

the comment @jensmikkelsen made led me change thinking how sitecore ad module working thinking how ldap filters work. more research on stackoverflow led stackoverflow answer had link ldap documentation. additional google search lead more ldap syntax documentation.

the key solution realize memberof did not work way thought. rather cascading down through group membership, returns direct members. in order further down membership chain using ldap_matching_rule_in_chain necessary. looks this:

(memberof:1.2.840.113556.1.4.1941:=(cn=group1,ou=groupsou,dc=x)) 

using jen's idea of using active directory browser work out correct filter led me values above. used both active directory browser because allowed me change user , active directory administration center because easier figure out how enter ldap filter same way use customfilter value in sitecore ad module.