Repository navigation
memberOf with groupOfUniqueNames not working #304
Description
Activity
@ookerberry works perfectly well for me (tested on Docker for MacOSX):
# ldapsearch -LLL -x -D cn=admin,dc=example,dc=org -w admin -b dc=example,dc=org -h 127.0.0.1 uid=john memberOf
dn: uid=john,ou=Users,dc=example,dc=org
memberOf: cn=admin,ou=Groups,dc=example,dc=orgFull search output and ldif file available here
It does not work for me as well. Latest openldap from docker, seems to be
1.2.4.UPD: the output is the same, I don't get
memberOfbut the search works fine (tested withgitea).@ookerberry @vityafx could you please post the complete output of slapcat run within your container
Again it works perfectly well for me for 1.2.4 on my MacOSX Docker@ookerberry @vityafx may be you could also try my initial ldif file from here
to see if it works properly or not@obourdon I am sorry, but I have no interest in spending time on it right now. I have a lot of my own stuff to do, so I pass. I hope someone else will help you.
From my side, I can say that
memberOfworks fine withuniqueMemberin the group. I used Apache Directory Studio to check this out but I had to enable a checkbox foroperational attributes. Once I ticked it,memberOfdid show in the window as an attribute. I guess, this checkbox modifies the search request somehow and makes it returnmemberOfas well. Also, search filters in mygiteainstance did work well with it, so I don't have this problem anymore.@vityafx no problem and many thanks for your answer. Hopefully this now seem to work for you. Will still dig into this later on to see if I can find something worth mentioning
Reacted by Shockingly Good@obourdon I really apologize for not helping you now, I would like to help. I am also not that good with ldap and don't even know about this
ldiffiles (yet). I don't also know when I will at least read about them and try, but I have done my ldap stuff. At least for now, every little thing I needed to do works, so I can finally forget it for a certain period of time. So, if I could and had a chance, I'd help you of course.I remain subscribed to this issue, so once I know I can help you or anyone else experiencing this problem, I'd post a comment for sure.
@vityafx do not worry, I am definitely no expert either, just may be a little bit more advanced than you are right now. In my case, I just need to use this container as a replacement for a full fledge mail system that I built several years ago which relies on LDAP for (virtual)mail accounts, forwarding, permissions, vacations, ... moving away from process based baremetal installation to docker on cloud ;-)
+1 for memberOf support
@HariSekhon sorry if it is not clear for me. Does your +1 means that memberOf support works well for you ?
per the configuration, it is supposed to work with groupOfUniqueNames
Reacted by Simon WakenhutReacted by Simon WakenhutSame issue for me on macos with osixia/openldap:1.2.4
the overlay only works for groupOfNames/member, but not working for groupOfUniqueNames/uniqueMember
@westwin @drhuh, guys from what you are respectively writing, it seems to me that you are contradicting each another. Doing more tests on my side showed that @drhuh is right (like @quanah also suggests in its own post)
@drhuh sorry but I have not enough expertise in this area to tell you if this can be debugged/fixed/relative to docker container or openldap itself
31 remaining items
Your previous bit was mostly correct. Something like
dn: cn=finance,ou=groups,dc=ldap,dc=example,dc=com objectclass: groupOfUniqueNames cn: finance uniqueMember: uid=jdoe,ou=users,dc=ldap,dc=example,dc=comshould work, assuming that jdoe DN exists, etc.
ok here is what i have now
i imported this ldif
# ou=groups,dc=ldap,dc=example,dc=com dn: ou=groups,dc=ldap,dc=example,dc=com objectclass: organizationalUnit objectclass: top ou: groups # cn=finance,ou=groups,dc=ldap,dc=example,dc=com dn: cn=finance,ou=groups,dc=ldap,dc=example,dc=com cn: finance uniqueMember: uid=jjordan,ou=users,dc=ldap,dc=example,dc=com uniqueMember: uid=bbritton,ou=users,dc=ldap,dc=example,dc=com objectclass: groupOfUniqueNames # cn=engineering,ou=groups,dc=ldap,dc=example,dc=com dn: cn=engineering,ou=groups,dc=ldap,dc=example,dc=com cn: engineering uniqueMember: uid=jjordan,ou=users,dc=ldap,dc=example,dc=com objectclass: groupOfUniqueNames # ou=users,dc=ldap,dc=example,dc=com dn: ou=users,dc=ldap,dc=example,dc=com objectclass: organizationalUnit objectclass: top ou: users # cn=Johnathan Jordan,ou=users,dc=ldap,dc=example,dc=com dn: cn=Johnathan Jordan,ou=users,dc=ldap,dc=example,dc=com cn: Johnathan Jordan gidnumber: 500 givenname: Johnathan homedirectory: /home/users/jjordan loginshell: /bin/bash objectclass: inetOrgPerson objectclass: posixAccount objectclass: top sn: Jordan uid: jjordan uidnumber: 1000 userpassword: PaSsWoRd123 # cn=Brandon Britton,ou=users,dc=ldap,dc=example,dc=com dn: cn=Brandon Britton,ou=users,dc=ldap,dc=example,dc=com cn: Brandon Britton gidnumber: 500 givenname: Brandon homedirectory: /home/users/bbritton loginshell: /bin/bash objectclass: inetOrgPerson objectclass: posixAccount objectclass: top sn: Britton uid: bbritton uidnumber: 1001 userpassword: PaSsWoRd123but when i try to run ldapsearch to find groups users are member of, i am not getting what i want. So not working.
Do you have an example ldif and ldapsearch command that works for you i can use @quanahldapsearch -D "cn=admin,dc=ldap,dc=example,dc=com" -w PaSsWoRd123 -p 389 -h localhost -b "dc=ldap,dc=example,dc=com" "(uid=bbritton)" uid cn memberof# extended LDIF # # LDAPv3 # base <dc=ldap,dc=example,dc=com> with scope subtree # filter: (uid=bbritton) # requesting: uid cn memberof # # Brandon Britton, users, ldap.bbops.xyz dn: cn=Brandon Britton,ou=users,dc=ldap,dc=example,dc=com cn: Brandon Britton uid: bbritton # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1ldapsearch -D "cn=admin,dc=ldap,dc=example,dc=com" -w PaSsWoRd123 -p 389 -h localhost -b "dc=ldap,dc=example,dc=com" "(uid=jjordan)" uid cn memberof# extended LDIF # # LDAPv3 # base <dc=ldap,dc=example,dc=com> with scope subtree # filter: (uid=jjordan) # requesting: uid cn memberof # # Johnathan Jordan, users, ldap.bbops.xyz dn: cn=Johnathan Jordan,ou=users,dc=ldap,dc=example,dc=com cn: Johnathan Jordan uid: jjordan # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1also did i do anything wrong?
thanks
Yes, this is incorrect. The uniqueMember attribute takes the DN of an entry. The user DNs in your database that you show are:
cn=Johnathan Jordan,ou=users,dc=ldap,dc=example,dc=com cn=Brandon Britton,ou=users,dc=ldap,dc=example,dc=comBut what you put in uniquemember is:
uniqueMember: uid=jjordan,ou=users,dc=ldap,dc=example,dc=com uniqueMember: uid=bbritton,ou=users,dc=ldap,dc=example,dc=comThe above do not appear to be valid DNs for your database. The term "DN" has an exact meaning. Overall, I would strongly advise taking some time to read up on LDAP terminology and structure.
@quanah still does not work
again if you have a sample ldif that works i can use that will be great to reduce the back and forthhere is what i have now
# ou=groups,dc=ldap,dc=example,dc=com dn: ou=groups,dc=ldap,dc=example,dc=com objectclass: organizationalUnit objectclass: top ou: groups # cn=finance,ou=groups,dc=ldap,dc=example,dc=com dn: cn=finance,ou=groups,dc=ldap,dc=example,dc=com cn: finance uniqueMember: cn=Johnathan Jordan,ou=users,dc=ldap,dc=example,dc=com uniqueMember: cn=Brandon Britton,ou=users,dc=ldap,dc=example,dc=com objectclass: groupOfUniqueNames # cn=engineering,ou=groups,dc=ldap,dc=example,dc=com dn: cn=engineering,ou=groups,dc=ldap,dc=example,dc=com cn: engineering uniqueMember: cn=Johnathan Jordan,ou=users,dc=ldap,dc=example,dc=com objectclass: groupOfUniqueNames # ou=users,dc=ldap,dc=example,dc=com dn: ou=users,dc=ldap,dc=example,dc=com objectclass: organizationalUnit objectclass: top ou: users # cn=Johnathan Jordan,ou=users,dc=ldap,dc=example,dc=com dn: cn=Johnathan Jordan,ou=users,dc=ldap,dc=example,dc=com cn: Johnathan Jordan gidnumber: 500 givenname: Johnathan homedirectory: /home/users/jjordan loginshell: /bin/bash objectclass: inetOrgPerson objectclass: posixAccount objectclass: top sn: Jordan uid: jjordan uidnumber: 1000 userpassword: PaSsWoRd123 # cn=Brandon Britton,ou=users,dc=ldap,dc=example,dc=com dn: cn=Brandon Britton,ou=users,dc=ldap,dc=example,dc=com cn: Brandon Britton gidnumber: 500 givenname: Brandon homedirectory: /home/users/bbritton loginshell: /bin/bash objectclass: inetOrgPerson objectclass: posixAccount objectclass: top sn: Britton uid: bbritton uidnumber: 1001 userpassword: PaSsWoRd123ldapsearch -D "cn=admin,dc=ldap,dc=example,dc=com" -w PaSsWoRd123 -p 389 -h localhost -b "dc=ldap,dc=example,dc=com" "(uid=bbritton)" uid cn memberof# extended LDIF # # LDAPv3 # base <dc=ldap,dc=example,dc=com> with scope subtree # filter: (uid=bbritton) # requesting: uid cn memberof # # Brandon Britton, users, ldap.example.com dn: cn=Brandon Britton,ou=users,dc=ldap,dc=example,dc=com cn: Brandon Britton uid: bbritton # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1ldapsearch -D "cn=admin,dc=ldap,dc=example,dc=com" -w PaSsWoRd123 -p 389 -h localhost -b "dc=ldap,dc=example,dc=com" "(uid=jjordan)" uid cn memberof# extended LDIF # # LDAPv3 # base <dc=ldap,dc=example,dc=com> with scope subtree # filter: (uid=jjordan) # requesting: uid cn memberof # # Johnathan Jordan, users, ldap.example.com dn: cn=Johnathan Jordan,ou=users,dc=ldap,dc=example,dc=com cn: Johnathan Jordan uid: jjordan # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1I've done the following:
a) Load the memberof configuration as provided by Osixia:
ldapmodify -x -H ldap:// -D cn=config -w secret -f ./memberof.ldif modifying entry "cn=module{0},cn=config" adding new entry "olcOverlay={0}memberof,olcDatabase={1}mdb,cn=config"b) Load your database:
ldapadd -x -H ldap:// -D dc=example,dc=com -w secret -f ./exampledb.ldif adding new entry "ou=groups,dc=ldap,dc=example,dc=com" adding new entry "cn=finance,ou=groups,dc=ldap,dc=example,dc=com" adding new entry "cn=engineering,ou=groups,dc=ldap,dc=example,dc=com" adding new entry "ou=users,dc=ldap,dc=example,dc=com" adding new entry "cn=Johnathan Jordan,ou=users,dc=ldap,dc=example,dc=com" adding new entry "cn=Brandon Britton,ou=users,dc=ldap,dc=example,dc=com"Now, this fails to generate memberOf because you created the users after you created the groups. This is one of the distinct failings of memberOf in its current form -- Users must exist in the database prior to them being added to a group for the overlay to work.
Now if I modify the groups:
ldapmodify -x -H ldap:// -D dc=example,dc=com -w secret dn: cn=finance,ou=groups,dc=ldap,dc=example,dc=com changetype: modify replace: uniqueMember uniqueMember: cn=Johnathan Jordan,ou=users,dc=ldap,dc=example,dc=com uniqueMember: cn=Brandon Britton,ou=users,dc=ldap,dc=example,dc=com modifying entry "cn=finance,ou=groups,dc=ldap,dc=example,dc=com" dn: cn=engineering,ou=groups,dc=ldap,dc=example,dc=com changetype: modify replace: uniqueMember uniqueMember: cn=Johnathan Jordan,ou=users,dc=ldap,dc=example,dc=com modifying entry "cn=engineering,ou=groups,dc=ldap,dc=example,dc=com"The memberOf attribute is correctly created:
ldapsearch -x -LLL -H ldap:// -D dc=example,dc=com -w secret -b dc=ldap,dc=example,dc=com "cn=Brandon Britton" memberOf dn: cn=Brandon Britton,ou=users,dc=ldap,dc=example,dc=com memberOf: cn=finance,ou=groups,dc=ldap,dc=example,dc=com ldapsearch -x -LLL -H ldap:// -D dc=example,dc=com -w secret -b dc=ldap,dc=example,dc=com "cn=Johnathan Jordan" memberOf dn: cn=Johnathan Jordan,ou=users,dc=ldap,dc=example,dc=com memberOf: cn=finance,ou=groups,dc=ldap,dc=example,dc=com memberOf: cn=engineering,ou=groups,dc=ldap,dc=example,dc=comReacted by encryptblockr, M9T, danielchu, sdrmlm, Dmitriy Tatarkin, Iskander Chanyshev, Duje Medak and z411Reacted by encryptblockr, Dmitriy Tatarkin and Duje Medak@quanah
you are the very best; no one is better!!!
thanks man..works now!!!Hi @quanah!
I also have setup the latest osixia/docker-openldap and memberOf with groupOfUniqueNames is working out of the box.
I did not change anything in the docker-image for that.
On the TOP of this thread nested groups or group of groups was discussed. For me it is not clear what i have to modify or setup to get this working. I hope you cold help me as detailed as you did with @encryptblockr :-)This is my LDAP Export:
dn: dc=example,dc=com objectClass: top objectClass: dcObject objectClass: organization o: examplecom dc: example dn: cn=admin,dc=example,dc=com objectClass: simpleSecurityObject objectClass: organizationalRole cn: admin description: LDAP administrator dn: cn=ldap,dc=example,dc=com cn: ldap objectClass: simpleSecurityObject objectClass: organizationalRole description: LDAP read only user dn: ou=people,dc=example,dc=com objectClass: top objectClass: organizationalUnit ou: people dn: ou=groups,dc=example,dc=com objectClass: top objectClass: organizationalUnit ou: groups dn: uid=max,ou=family,ou=people,dc=example,dc=com objectClass: posixAccount objectClass: top objectClass: inetOrgPerson gidNumber: 0 givenName: Max sn:: U2NobMO2Z2w= homeDirectory: /home/max cn: max uidNumber: 58345 mail: max@example.com uid: max dn: uid=michael,ou=family,ou=people,dc=example,dc=com objectClass: posixAccount objectClass: top objectClass: inetOrgPerson gidNumber: 0 givenName: Michael sn:: U2NobMO2Z2w= homeDirectory: /home/michael cn: michael uidNumber: 59097 mail: michael@example.com uid: michael dn: ou=admins,ou=people,dc=example,dc=com objectClass: top objectClass: organizationalUnit ou: admins dn: ou=family,ou=people,dc=example,dc=com objectClass: top objectClass: organizationalUnit ou: family dn: cn=users,ou=groups,dc=example,dc=com objectClass: groupOfUniqueNames objectClass: top cn: users uniqueMember: uid=max,ou=family,ou=people,dc=example,dc=com uniqueMember: uid=michael,ou=family,ou=people,dc=example,dc=com dn: cn=admins,ou=groups,dc=example,dc=com objectClass: groupOfUniqueNames objectClass: top cn: admins uniqueMember: uid=max,ou=family,ou=people,dc=example,dc=com dn: cn=nextcloud.users,ou=groups,dc=example,dc=com objectClass: groupOfUniqueNames objectClass: top cn: nextcloud.users uniqueMember: uid=max,ou=family,ou=people,dc=example,dc=com uniqueMember: uid=michael,ou=family,ou=people,dc=example,dc=com dn: cn=nextcloud.admins,ou=groups,dc=example,dc=com objectClass: groupOfUniqueNames objectClass: top cn: nextcloud.admins uniqueMember: uid=max,ou=family,ou=people,dc=example,dc=comBest regards
MaxNested groups requires OpenLDAP 2.5 and the slapo-dynlist overlay as a replacement for the broken slapo-memberOf overlay.
Thank you @quanah!
But 2.5 is in alpha state. Do you note when a stable version will be released?
BRWhen it's ready. Which depends on how quickly the development team makes it through the open issues for 2.5.
hi guys ,
anyone resolve this problem ?? because tried to do a lot of way's to enable memberOf ... im using the version 1.2.4 .... and i have the unique member as read in this foro ... but still i have problems when i do the memberof search... please anyone can help me ?
@joaqquin89 - From the looks of that screenshot, I'd say you should be getting the
memberOfattribute when you search for that user.Care to share your
ldapsearchcommand?memberOfworks for me but only if specifically requested inldapsearch, otherwise it's missing in the response. Is it correct behavior?Output snip:
$ docker exec ldap ldapsearch -x -H ldap://localhost:389 -b dc=... -D cn=admin,dc=... -w admin '(cn=tester)' memberOf # requesting: memberOf dn: cn=tester,ou=Users,dc=... memberOf: cn=... $ docker exec ldap ldapsearch -x -H ldap://localhost:389 -b dc=... -D cn=admin,dc=... -w admin '(cn=tester)' # requesting: ALL dn: cn=tester,ou=Users,dc=... objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson cn: tester sn: Tester userPassword:: ...If that helps anyone having the "memberOf should be true" issue : After a group import (usually when it's done before creating the users specified as uniqueMember), LDAP is unable to refresh the memberOf values. you have to modify and update each groups to update the memberOf index.
It seems from the comments on #49 that memberOf is included in this docker image and should be working as long as the group is of objectClass: groupOfUniqueNames and if each member of the group is a uniqueMember.
Is this right?
I am not getting any memberOf info when I search.
Here is an example of an LDIF to add a group and member:
dn: cn=admin,ou=groups,dc=example,dc=comobjectClass: groupofuniquenamescn: admindescription: Admin usersuniquemember: uid=john,ou=users,dc=example,dc=comHere is an example of how I'm searching:
ldapsearch -x -D cn=admin,dc=example,dc=com -w admin -b dc=example,dc=com -h 127.0.0.1 uid=john memberOfThe output is just:
dn: cn=john,ou=users,dc=example,dc=combut I'd expect it to be:
dn: cn=john,ou=users,dc=example,dc=commemberOf: cn=admin,ou=groups,dc=example,dc=comShould this be working or am I doing something wrong?