Handle user primary group in AD

[whitlockjc]

In an AD environment a user's primary group is not stored in the member attribute. Instead, the group's RID value is stored in the primaryGroupID attribute of the user. To find the user's primary group name you need to find the domain SID and then search for the group that has the SID value domain SID-group RID in their objectSid attribute. Attached is an example for finding a user's primary group written using py-ldap. The function sid2str is borrowed from web2ldap. I have some more on AD primary groups here:

http://blogs.freebsdish.org/tmclaugh/2010/07/21/finding-a-users-primary-group-in-ad/