pgina/pgina — comment on commit ee7c7f5dc276ef01f1408bb990636b3340652aed
File: Plugins/LocalMachine/LocalAccount.cs line 450
By nate-yocom:

Hmm... this is an interesting approach. I wonder how it plays with nested group membership though? The UserPrincipal.GetGroups() returns a list of primary groups I think, whereas iterating over groups and asking if a user is a member is subtly different (perhaps). Consider the case:

User joe is a member of "Students" group
Students group is a member of the "Lab Users" group

UserPrincipal(joe).GetGroups() would return only "Students", not Students and "Lab Users"

However, iterating over each group would result in:

Is user Joe in the "Students" group: Yes
Is user Joe in the "Lab Users" group: Yes

Resulting in an exploded list of all effective group memberships. If this group list is then used to sync, then Joe will be directly placed in the "Lab Users" group, and the admin has lost the effectiveness/usefulness of nesting groups.

Note - I am assuming here that UserPrincipal.GetGroups() returns the non-exploded list, and the UserPrincipal.IsMemberOf does a full nested check - might be worth a quick debugger verification.