Ldap – LDIFDE command returns “Invalid Parameter: Bad argument ‘-r'”

It might be the same case I've run onto not a long time ago. If your AD group has too many members, it caused such error in Linux (somewhere on getent level or just before it - ldapsearch worked fine).

More precisely the error is not about a specific number of members, but rather about the number of characters per "group line" (think line from /etc/group) being greater than 1023 characters. I didn't look into why this limit is there and why 1024. I've just created a second group and moved excessive members there.

What application are you trying to configure.

There large majority of application that have some level of LDAP support as an LDAP client, simply have no support for nested groups.

Short of modifying the software, you may be out of luck.

If your LDAP server happens to be Microsoft Active Directory, then there is a non-standard search filter, that may help you.

See: - http://support.microsoft.com/kb/914828 - http://msdn.microsoft.com/en-us/library/windows/desktop/aa746475(v=vs.85).aspx

The LDAP_MATCHING_RULE_IN_CHAIN is a matching rule OID that is designed to provide a method to look up the ancestry of an object. Many applications using AD and AD LDS usually work with hierarchical data, which is ordered by parent-child relationships. Previously, applications performed transitive group expansion to figure out group membership, which used too much network bandwidth; applications needed to make multiple roundtrips to figure out if an object fell "in the chain" if a link is traversed through to the end.