Thanks Dan!
Basically, I also have concern about the performance. Because in that case, when figuring out how many users in a group, I need to not only consider the group's membership (memberUID) attribute, but also user's gidNumber attribute (I am trying to write a Java application talk to my OpenLDAP server with JNDI).
So I tentatively want to ignore that case, and only reply on group's membership (memberUID) attribute to determine group membership, but I am not sure if this is acceptable in general. Hope you can give me some advise :-)
Regards, Qian