AUTH_LDAP_FIND_GROUP_PERMS setting unclear

It is not clear (to me at least) what AUTH_LDAP_FIND_GROUP_PERMS does exactly. From the documentation:

If True, LDAPBackend will furnish group permissions based on the LDAP groups the authenticated user belongs to.

There is also the following hint in the README, which is already a bit more clear to me:

Use LDAP group membership to calculate group permissions.

When reading the source code, my understanding is

If True, the LDAPBackend use group membership to calculate group permissions, that is: if a user is a member a given LDAP group, the permissions of the Django group with the same name will be given to that user.

If this understanding is correct, I’m still a bit puzzled:

• Isn’t this the default behavior in Django, i.e. why is there a separate (default False) option for this?
• What is the relationship with AUTH_LDAP_MIRROR_GROUPS, i.e. wouldn’t setting that setting to True imply the behavior regardless of the value for AUTH_LDAP_USER_FLAGS_BY_GROUP?

[vanschelven]

A review would be much appreciated!

Done, looks good to me!

[vanschelven]

Thanks very much for the very clear explanation! For me personally this closes the issue; I’m leaving it up to you to close it if/when you update the documentation (or to close it without updating the documentation if you so prefer).