LDAP group members may be ignored when the member's RDN starts with cn (and possibly other attribute names).

[jvanhill]

Group membership for LDAP group members may be incomplete when a member's RDN starts with CN or another LDAP attribute that is included userIdMap.

Take the following LDIFF for a group:

dn: cn=group,o=acme.com
objectclass: groupofnames
objectclass: top
cn: group
member: cn=user1,o=acme.com
member: uid=user2,o=acme.com

It is possible that member cn=user1,o=acme.com may be ignored, while member uid=user2,o=acme.com is included in group membership.

After the fix, the solution is to add both RDN's to the userIdMap (userIdMap="*:cn;*:uid"). There is no work around to support both RDNs prior to the fix.