Performing a group lookup against FreeIPA servers is extremely expensive, especially when nested groups are in play. However, FreeIPA now has an attribute {{{memberindirect}}} on groups that includes all users that are members of child groups.

We could significantly improve our group lookup performance against FreeIPA by reading the {{{memberindirect}}} object instead of actually proceeding through nested group lookups.

We can also speed up the saving of groups by taking a bit of a cheap shortcut. We know that the user and group names in FreeIPA are guaranteed to have a particular format (users will always be in the cn=Users,cn=Accounts subtree, groups in cn=Groups) so we can ignore groups and just construct usernames from the DNs of the {{{member}}} and {{{memberindirect}}} attributes of the group.