Have you tried turning on the group_ad_nesting option? I am not sure whether the AD implementation maps to the IdM implementation at all, but the idea seems similar. If that doesn't work, we could probably implement a similar option specific to IdM.
Have you tried turning on the group_ad_nesting option? I am not sure whether the AD implementation maps to the IdM implementation at all, but the idea seems similar. If that doesn't work, we could probably implement a similar option specific to IdM.