My guess is that your config on the server is not right.  So it looks like you are using the slap.d which is what i am using as well.  (I need to upload some updated rpms I think to gradientzero as well).<br><br>I used this site to help me get my configuration working <br>

<a href="http://www.zytrax.com/books/ldap/ch6/slapd-config.html">http://www.zytrax.com/books/ldap/ch6/slapd-config.html</a><br><br>So my directory structural looks like:<br><br>NOTE: While you can edit these files through the filesystem I higly recommend that you edit the files through ldap commands.  I use Apache Directory Studio as my GUI type front end and use ldapvi when I just one to make changes to values already in the ldap server and then to make major changes I use ldapmodify to make them.<br>

  <br>PWD=/etc/openldap/slapd.d<br># ls -lR<br>.:<br>total 8<br>drwxr-x--- 5 ldap ldap 4096 May 26 16:48 cn=config<br>-rw------- 1 ldap ldap 1312 May 26 17:10 cn=config.ldif<br><br>./cn=config:<br>total 100<br>-rw------- 1 ldap ldap   575 Sep  1  2009 cn=module{0}.ldif<br>

drwxr-x--- 2 ldap ldap  4096 Mar  4 12:42 cn=schema<br>-rw------- 1 ldap ldap 61687 Sep  1  2009 cn=schema.ldif<br>drwxr-x--- 2 ldap ldap  4096 Sep  2  2009 olcDatabase={0}config<br>-rw------- 1 ldap ldap  2067 Nov 12  2009 olcDatabase={0}config.ldif<br>

drwxr-x--- 2 ldap ldap  4096 Mar  4 11:36 olcDatabase={1}bdb<br>-rw------- 1 ldap ldap  4093 May 26 16:48 olcDatabase={1}bdb.ldif<br>-rw------- 1 ldap ldap  2041 May 21 13:31 olcDatabase={-1}frontend.ldif<br>-rw------- 1 ldap ldap   522 Sep  1  2009 olcDatabase={2}monitor.ldif<br>

<br>/cn=config/cn=schema:<br>...&lt;SCHEMAS in this directory deleted to make this shorter&gt;.<br><br><br>./cn=config/olcDatabase={0}config:<br>total 4<br>-rw------- 1 ldap ldap 385 Sep  1  2009 olcOverlay={0}syncprov.ldif<br>

<br>./cn=config/olcDatabase={1}bdb:<br>total 24<br>-rw------- 1 ldap ldap 385 Sep  1  2009 olcOverlay={0}syncprov.ldif<br>-rw------- 1 ldap ldap 474 Sep  2  2009 olcOverlay={1}ppolicy.ldif<br>-rw------- 1 ldap ldap 397 Sep  3  2009 olcOverlay={2}memberof.ldif<br>

-rw------- 1 ldap ldap 494 Sep  2  2009 olcOverlay={3}refint.ldif<br>-rw------- 1 ldap ldap 425 Sep  9  2009 olcOverlay={4}dynlist.ldif<br>-rw------- 1 ldap ldap 530 Mar  4 11:36 olcOverlay={5}unique.ldif<br><br>Now for some listing of my ldifs that you thin you are needing to see.<br>

<br># cat cn\=config.ldif <br>dn: cn=config<br>objectClass: olcGlobal<br>cn: config<br>olcConfigDir: /etc/openldap/slapd.d<br>olcAttributeOptions: lang-<br>olcAuthzPolicy: none<br>olcConnMaxPending: 100<br>olcConnMaxPendingAuth: 1000<br>

olcGentleHUP: FALSE<br>olcIdleTimeout: 0<br>olcIndexSubstrIfMaxLen: 4<br>olcIndexSubstrIfMinLen: 2<br>olcIndexSubstrAnyLen: 4<br>olcIndexSubstrAnyStep: 2<br>olcIndexIntLen: 4<br>olcLocalSSF: 71<br>olcReadOnly: FALSE<br>olcReverseLookup: FALSE<br>

olcSaslSecProps: noplain,noanonymous<br>olcSockbufMaxIncoming: 262143<br>olcSockbufMaxIncomingAuth: 16777215<br>olcTLSCipherSuite: HIGH:MEDIUM:+SSLv2<br>olcTLSVerifyClient: never<br>structuralObjectClass: olcGlobal<br>olcTLSCACertificateFile: /etc/pki/certmaster/ca.cert<br>

entryUUID: e686e389-d0eb-4987-a240-fee46028c0a6<br>creatorsName: cn=config<br>createTimestamp: 20090901234827Z<br>olcTLSCRLCheck: none<br>olcTLSCertificateFile: /etc/openldap/cacerts/server.cert<br>olcTLSCertificateKeyFile: /etc/openldap/cacerts/key.pem<br>

olcServerID: 2 ldaps://2<br>olcServerID: 1 ldaps://1<br>olcServerID: 3 ldaps://3<br>olcPidFile: /var/run/openldap/slapd.pid<br>olcToolThreads: 1<br>olcThreads: 16<br><br># cat cn\=config/cn\=module\{0\}.ldif <br>dn: cn=module{0}<br>

objectClass: olcModuleList<br>cn: module{0}<br>olcModulePath: /usr/lib64/openldap<br>olcModuleLoad: {0}<a href="http://dynlist.la">dynlist.la</a><br>olcModuleLoad: {1}<a href="http://pcache.la">pcache.la</a><br>olcModuleLoad: {2}<a href="http://ppolicy.la">ppolicy.la</a><br>

olcModuleLoad: {3}<a href="http://refint.la">refint.la</a><br>olcModuleLoad: {4}<a href="http://retcode.la">retcode.la</a><br>olcModuleLoad: {5}<a href="http://syncprov.la">syncprov.la</a><br>olcModuleLoad: {6}<a href="http://unique.la">unique.la</a><br>

olcModuleLoad: {7}<a href="http://memberof.la">memberof.la</a><br>structuralObjectClass: olcModuleList<br><br># cat cn\=config/olcDatabase\=\{1\}bdb/olcOverlay\=\{4\}dynlist.ldif <br>dn: olcOverlay={4}dynlist<br>objectClass: olcOverlayConfig<br>

objectClass: olcDynamicList<br>olcOverlay: {4}dynlist<br>structuralObjectClass: olcDynamicList<br><br><br>I think these should help you find where you have gone wrong with the configuration of the slapd configuration.<br>

<br>So in my actual directory I have an ou=Systems,dc=domain,dc=ZZZ<br><br><br>cn=sysadmin,ou=Systems,dc=domain,dc=ZZZ<br>cn: sysadmin<br>objectClass: top<br>objectClass: groupOfNames<br>objectClass: labeledURIObject<br>
member: uid=nobody,ou=People,dc=domain,dc=ZZZ<br>
labeledURI: ldap:///ou=People,dc=domain,dc=ZZZ??one?(host=sysadmin)<br><br>The nobody user is a fake user that is in all my groups the user cannot login the ladelURI says that if a use has host=sysadmin they should be in this group.<br>

<br>/etc/ldap.conf:<br>pam_groupdn cn=sysadmin,ou=Systems,dc=domain,dc=ZZZ<br>pam_member_attribute member<br><br>Also note that I hacked my schema to allow the host attribute in the PosixAccount users.<br><br><br><div class="gmail_quote">

On Wed, Jun 2, 2010 at 7:06 AM, Shamika Joshi <span dir="ltr">&lt;<a href="mailto:shamika.joshi@gmail.com">shamika.joshi@gmail.com</a>&gt;</span> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">

Hi<br>I&#39;ve followed Adam&#39;s post below on &#39;using pam_groupdn to use dynlist&#39; to my query posted couple of months back and after revisiting this configuration facing issue with doing ssh to client machine with dynamic member of the group. It works correctly for the static members of the same group.Could you figure out if I&#39;m missing something here??<br>


<br><span style="font-family: verdana,sans-serif;">Currently using Ubuntu 9.10 which uses slapd.d configuration directory.</span> <br style="font-family: verdana,sans-serif;"><font style="color: rgb(0, 0, 102);" size="1"><br style="font-family: verdana,sans-serif;">


<span style="font-family: verdana,sans-serif;"><br style="font-family: verdana,sans-serif;"><span style="font-family: verdana,sans-serif;">dn: cn=module{0},cn=config</span><br style="font-family: verdana,sans-serif;"><span style="font-family: verdana,sans-serif;">objectClass: olcModuleList</span><br style="font-family: verdana,sans-serif;">


<span style="font-family: verdana,sans-serif;">cn: module{0}</span><br style="font-family: verdana,sans-serif;"><span style="font-family: verdana,sans-serif;">olcModulePath: /usr/lib/ldap</span><br style="font-family: verdana,sans-serif;">


<span style="font-family: verdana,sans-serif;">olcModuleLoad: {0}back_hdb</span><br style="font-family: verdana,sans-serif;"><b><span style="font-family: verdana,sans-serif;">olcModuleLoad: {1}<a href="http://dynlist.la" target="_blank">dynlist.la</a></span></b><br style="font-family: verdana,sans-serif;">


<span style="font-family: verdana,sans-serif;">olcModuleLoad: {2}syncprov</span><br>dn: olcDatabase={1}hdb,cn=config</span><br style="font-family: verdana,sans-serif;"><span style="font-family: verdana,sans-serif;">objectClass: olcDatabaseConfig</span><br style="font-family: verdana,sans-serif;">


<span style="font-family: verdana,sans-serif;">objectClass: olcHdbConfig</span><br style="font-family: verdana,sans-serif;"><span style="font-family: verdana,sans-serif;">olcDatabase: {1}hdb</span><br style="font-family: verdana,sans-serif;">


<span style="font-family: verdana,sans-serif;">olcDbDirectory: /var/lib/ldap</span><br style="font-family: verdana,sans-serif;"><span style="font-family: verdana,sans-serif;">olcSuffix: dc=testlab,dc=com</span><br style="font-family: verdana,sans-serif;">


<span style="font-family: verdana,sans-serif;">olcAccess: {0}to attrs=userPassword,shadowLastChange by dn=&quot;cn=admin,dc=testla</span><br style="font-family: verdana,sans-serif;"><span style="font-family: verdana,sans-serif;"> b,dc=com&quot; write by anonymous auth by self write by * none</span><br style="font-family: verdana,sans-serif;">


<span style="font-family: verdana,sans-serif;">olcAccess: {1}to dn.base=&quot;&quot; by * read</span><br style="font-family: verdana,sans-serif;"><span style="font-family: verdana,sans-serif;">olcAccess: {2}to * by dn=&quot;cn=admin,dc=testlab,dc=com&quot; write by * read</span><br style="font-family: verdana,sans-serif;">


<span style="font-family: verdana,sans-serif;">olcLastMod: TRUE</span><br style="font-family: verdana,sans-serif;"><span style="font-family: verdana,sans-serif;">olcRootDN: cn=admin,dc=testlab,dc=com</span><br style="font-family: verdana,sans-serif;">


<span style="font-family: verdana,sans-serif;">olcRootPW: 1234</span><br style="font-family: verdana,sans-serif;"><span style="font-family: verdana,sans-serif;">olcDbCheckpoint: 512 30</span><br style="font-family: verdana,sans-serif;">


<span style="font-family: verdana,sans-serif;">olcDbConfig: {0}set_cachesize 0 2097152 0</span><br style="font-family: verdana,sans-serif;"><span style="font-family: verdana,sans-serif;">olcDbConfig: {1}set_lk_max_objects 1500</span><br style="font-family: verdana,sans-serif;">


<span style="font-family: verdana,sans-serif;">olcDbConfig: {2}set_lk_max_locks 1500</span><br style="font-family: verdana,sans-serif;"><span style="font-family: verdana,sans-serif;">olcDbConfig: {3}set_lk_max_lockers 1500</span><br style="font-family: verdana,sans-serif;">


<span style="font-family: verdana,sans-serif;">olcDbIndex: uid pres,eq</span><br style="font-family: verdana,sans-serif;"><span style="font-family: verdana,sans-serif;">olcDbIndex: cn,sn,mail pres,eq,approx,sub</span><br style="font-family: verdana,sans-serif;">


<span style="font-family: verdana,sans-serif;">olcDbIndex: objectClass eq</span><br style="font-family: verdana,sans-serif;"><br style="font-family: verdana,sans-serif;"><b><span style="font-family: verdana,sans-serif;">dn: olcOverlay={0}dynlist,olcDatabase={1}hdb,cn=config</span><br style="font-family: verdana,sans-serif;">


<span style="font-family: verdana,sans-serif;">objectClass: olcOverlayConfig</span><br style="font-family: verdana,sans-serif;"><span style="font-family: verdana,sans-serif;">objectClass: olcDynamicList</span><br style="font-family: verdana,sans-serif;">


<span style="font-family: verdana,sans-serif;">olcOverlay: {0}dynlist</span><br style="font-family: verdana,sans-serif;"><span style="font-family: verdana,sans-serif;">olcDlAttrSet: {0}groupOfNames labeledURI membe</span>r</b></font><br>


<br><b>ldap.conf</b> on client machine contains<br><font style="font-family: verdana,sans-serif;" size="1"><span style="color: rgb(0, 0, 102);"># Group to enforce membership of</span><br style="color: rgb(0, 0, 102);"><b><span style="color: rgb(0, 0, 102);">pam_groupdn cn=u910desk,ou=Machines,dc=testlab,dc=com</span></b><br style="color: rgb(0, 0, 102);">


<br style="color: rgb(0, 0, 102);"><span style="color: rgb(0, 0, 102);"># Group member attribute</span><br style="color: rgb(0, 0, 102);"><b><span style="color: rgb(0, 0, 102);">pam_member_attribute member</span></b></font><b><br>


</b><br>I have added following group<br><font style="font-family: verdana,sans-serif;" size="1"><b style="color: rgb(0, 0, 102);">dn: cn=u910desk,ou=Machines,dc=testlab,dc=com</b><br style="color: rgb(0, 0, 102);"><span style="color: rgb(0, 0, 102);">cn: u910desk</span><br style="color: rgb(0, 0, 102);">


<span style="color: rgb(0, 0, 102);">ipHostNumber: 172.17.5.232</span><br style="color: rgb(0, 0, 102);"><span style="color: rgb(0, 0, 102);">objectClass: top</span><br style="color: rgb(0, 0, 102);"><span style="color: rgb(0, 0, 102);">objectClass: groupOfNames</span><br style="color: rgb(0, 0, 102);">


<span style="color: rgb(0, 0, 102);">objectClass: labeledURIObject</span><br style="color: rgb(0, 0, 102);"><span style="color: rgb(0, 0, 102);">objectClass: ipHost</span><b style="color: rgb(0, 0, 102);"><br>labeledURI: ldap://<a href="http://172.17.0.200/ou=Users,dc=testlab,dc=com??one?%28host=cms3%29" target="_blank">172.17.0.200/ou=Users,dc=testlab,dc=com??one?(host=cms3)</a></b><br style="color: rgb(0, 0, 102);">


<span style="color: rgb(0, 0, 102);">member: cn=placeholder,dc=testlab,dc=com</span><br style="color: rgb(0, 0, 102);"><span style="color: rgb(0, 0, 102);">member: uid=henry,ou=Users,dc=testlab,dc=com</span></font><br style="font-family: verdana,sans-serif;">


<br>Also a user with host=cms3 entry, which should become dynamic member &#39;u910desk&#39; after resolving labledURI above<br><font size="1"><br style="color: rgb(0, 0, 102);"><b style="color: rgb(0, 0, 102); font-family: verdana,sans-serif;">dn: uid=jack,ou=Users,dc=testlab,dc=com</b><br style="color: rgb(0, 0, 102); font-family: verdana,sans-serif;">


<span style="color: rgb(0, 0, 102); font-family: verdana,sans-serif;">cn: jack</span><br style="color: rgb(0, 0, 102); font-family: verdana,sans-serif;"><span style="color: rgb(0, 0, 102); font-family: verdana,sans-serif;">sn: jack</span><br style="color: rgb(0, 0, 102); font-family: verdana,sans-serif;">


<span style="color: rgb(0, 0, 102); font-family: verdana,sans-serif;">givenName: jack</span><br style="color: rgb(0, 0, 102); font-family: verdana,sans-serif;"><span style="color: rgb(0, 0, 102); font-family: verdana,sans-serif;">uid: jack</span><br style="color: rgb(0, 0, 102); font-family: verdana,sans-serif;">


<span style="color: rgb(0, 0, 102); font-family: verdana,sans-serif;">uidNumber: 1002</span><br style="color: rgb(0, 0, 102); font-family: verdana,sans-serif;"><span style="color: rgb(0, 0, 102); font-family: verdana,sans-serif;">gidNumber: 513</span><br style="color: rgb(0, 0, 102); font-family: verdana,sans-serif;">


<span style="color: rgb(0, 0, 102); font-family: verdana,sans-serif;">homeDirectory: /home/jack</span><br style="color: rgb(0, 0, 102); font-family: verdana,sans-serif;"><span style="color: rgb(0, 0, 102); font-family: verdana,sans-serif;">loginShell: /bin/bash</span><br style="color: rgb(0, 0, 102); font-family: verdana,sans-serif;">


<span style="color: rgb(0, 0, 102); font-family: verdana,sans-serif;">gecos: System User</span><br style="color: rgb(0, 0, 102); font-family: verdana,sans-serif;"><span style="color: rgb(0, 0, 102); font-family: verdana,sans-serif;">host: cms3</span><br style="color: rgb(0, 0, 102); font-family: verdana,sans-serif;">


<span style="color: rgb(0, 0, 102); font-family: verdana,sans-serif;">objectClass: top</span><br style="color: rgb(0, 0, 102); font-family: verdana,sans-serif;"><span style="color: rgb(0, 0, 102); font-family: verdana,sans-serif;">objectClass: person</span><br style="color: rgb(0, 0, 102); font-family: verdana,sans-serif;">


<span style="color: rgb(0, 0, 102); font-family: verdana,sans-serif;">objectClass: organizationalPerson</span><br style="color: rgb(0, 0, 102); font-family: verdana,sans-serif;"><span style="color: rgb(0, 0, 102); font-family: verdana,sans-serif;">objectClass: inetOrgPerson</span><br style="color: rgb(0, 0, 102); font-family: verdana,sans-serif;">


<span style="color: rgb(0, 0, 102); font-family: verdana,sans-serif;">objectClass: posixAccount</span><br style="color: rgb(0, 0, 102); font-family: verdana,sans-serif;"><span style="color: rgb(0, 0, 102); font-family: verdana,sans-serif;">objectClass: shadowAccount</span><br style="color: rgb(0, 0, 102); font-family: verdana,sans-serif;">


<span style="color: rgb(0, 0, 102); font-family: verdana,sans-serif;">objectClass: hostobj</span><br style="color: rgb(0, 0, 102); font-family: verdana,sans-serif;"><span style="color: rgb(0, 0, 102); font-family: verdana,sans-serif;">shadowMax: 45</span></font><br style="color: rgb(0, 0, 102); font-family: verdana,sans-serif;">


<br style="color: rgb(0, 0, 102);"><br>However when I run search for member of group &#39;u910desk&#39; it returns following : member list does not contain entry of user &#39;jack&#39; here<br><br style="font-family: verdana,sans-serif;">


<font size="1"><span style="font-family: verdana,sans-serif;">$l</span><span style="color: rgb(0, 0, 102); font-family: verdana,sans-serif;">dapsearch -xLLL -b &#39;cn=u910desk,ou=Machines,dc=testlab,dc=com&#39; member</span><br style="color: rgb(0, 0, 102); font-family: verdana,sans-serif;">


<span style="color: rgb(0, 0, 102); font-family: verdana,sans-serif;">dn: cn=u910desk,ou=Machines,dc=testlab,dc=com</span><br style="color: rgb(0, 0, 102); font-family: verdana,sans-serif;"><span style="color: rgb(0, 0, 102); font-family: verdana,sans-serif;">member: cn=placeholder,dc=testlab,dc=com</span><br style="color: rgb(0, 0, 102); font-family: verdana,sans-serif;">


<span style="color: rgb(0, 0, 102); font-family: verdana,sans-serif;">member: uid=henry,ou=Users,dc=testlab,dc=com</span><br></font><br>For same reason(not sure tho) I think I&#39;m not able to ssh to this client using &#39;jack&#39;, however ssh using &#39;henry&#39; works it being a static member of &#39;u910desk&#39;.<br>


<font style="font-family: verdana,sans-serif;" size="1"><br></font><font style="color: rgb(0, 0, 102); font-family: verdana,sans-serif;" size="1">admins@u910desk:~$ ssh jack@localhost<br>jack@localhost&#39;s password:<br>


You must be a member of cn=u910desk,ou=Machines,dc=testlab,dc=com to login.<br>Connection closed by ::1<br>admins@u910desk:~$<br>admins@u910desk:~$<br>admins@u910desk:~$<br>admins@u910desk:~$ ssh henry@localhost<br>henry@localhost&#39;s password:<br>


Linux u910desk 2.6.31-17-generic #54-Ubuntu SMP Thu Dec 10 17:01:44 UTC 2009 x86_64<br><br>To access official Ubuntu documentation, please visit:<br><a href="http://help.ubuntu.com/" target="_blank">http://help.ubuntu.com/</a><br>

<br>164 packages can be updated.<br>
90 updates are security updates.<br><br>Last login: Wed Jun  2 17:10:19 2010 from localhost<br>henry@u910desk:~$</font><font size="2"><br></font><br><br>Any help in this matter will be highly appreciated.<br><br>Thanks in advance<br>


Shamika<br><br><br><br><div class="gmail_quote">On Sat, Dec 12, 2009 at 4:53 AM, Adam Hough <span dir="ltr">&lt;<a href="mailto:adam@gradientzero.com" target="_blank">adam@gradientzero.com</a>&gt;</span> wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">I am guessing you are either using RHEL5, Centos5 or some other RHEL5 based distro.  I replaced the openldap that was on my centos5 machines with an newer version at 2.4.16+patches.<br>



<br>I have uploaded the rpms and srpms of what I used which you can do a drop in replacement of the RHEL5 based openldap rpms.<br>

<a href="http://www.gradientzero.com/openldap/" target="_blank">http://www.gradientzero.com/openldap/</a><br><br>I do not remember for sure but I think I had to force one or 2 of the packages it get it to install but once everyhting is installed then it ran fine for me.  I have 3 ldap servers using this version setup in a multi-master setup.<br>





<br>Since I am doing a multimastet setup, I do not use slapd.conf but rather the slapd.d configuration directory though the dynlist overlay should work with slapd.conf as well.<br><font color="#888888"><br><br>- Adam</font><br>



<div><div><div class="gmail_quote"><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><div><div><br><br><div class="gmail_quote">On Fri, Dec 11, 2009 at 4:18 AM, Adam Hough <span dir="ltr">&lt;<a href="mailto:adam@gradientzero.com" target="_blank">adam@gradientzero.com</a>&gt;</span> wrote:<br>



<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">


There are other ways to populate the pam_groupdn that you have associated with each machine but those all correspond to some attribute in the user&#39;s profile.<br><br>I have pam_groupdn setup like this<br><br>/etc/ldap.conf:<br>









pam_groupdn cn=&lt;GROUP_NAME&gt;,ou=Systems,dc=domain,dc=com<br>pam_member_attribute member<br><br>cn=&lt;GROUP_NAME&gt;,ou=Systems,dc=domain,dc=com<br>cn: &lt;GROUP_NAME&gt;<br>objectClass: top<br>objectClass: groupOfNames<br>









objectClass: labeledURIObject<br>member: uid=nobody,ou=People, dc=domain,dc=com<br>labeledURI: ldap:///ou=People,dc=domain,dc=com??one?(host=&lt;type of system&gt;)<br>labeledURI: ldap:///ou=People,dc=domain,dc=com??one?(gidNumber=XXXX)<br>









<br>So as you can see you can have as many labeledURI attributes as you want or need.  I tend to use the host name function of what the host does. <br><br>This is how my account profile would look:<br>uid=&lt;MYUSERID&gt;,ou=People,dc=domain,dc=com<br>









host: &quot;cluster&quot;<br>host: sysadmin<br><br>So &quot;cluster&quot; is a compute cluster that we have and thus for all those machines the pam_groupdn cn=&quot;cluster&quot;,ou=Systems,dc=domain,dc=com, and for machines where only the sysadmins login to then pam_groupdn cn=sysadmin,ou=Systems,dc=domain,dc=com.<br>









<br>As long as you can for a labeledURI: ldap:///ou=People,dc=domain,dc=com??one?&lt;attribute&gt;=&lt;value&gt;) type search you can use it to auto populate the group.<br><br>Summary:<br>* Do to not think of the host attribute as host = hostname but as host = type of machine and that you can have more then one labeledURI per group to help populate the group.<br>









* Use good gidNumbers for groups to help auto populate groupOfName style groups.<br><font color="#888888"><br><br><br>- Adam</font><div><div></div><div><br><br><br><div class="gmail_quote">On Wed, Dec 9, 2009 at 4:01 AM, Shamika Joshi <span dir="ltr">&lt;<a href="mailto:shamika.joshi@gmail.com" target="_blank">shamika.joshi@gmail.com</a>&gt;</span> wrote:<br>









<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">Hi Adam,<br>I&#39;m able to get host auth working by using host attribute.But the drawback of that is everytime there a new machine, I have to add that host to all the users I want to grant access to. If I decide to do it based on group membership, I can use pam_groupdn but then it does not allow multiple group entries there, plus it has to be managed on client side,which is even more undesirable by any administrator.<br>










<br>I went through this article but I&#39;m not sure if it will work if I have some members already associated with some groups. Like ldap1 &amp; ldap2 members of qagroup &amp; ldap3 &amp; ldap4 members of sysadmin, would this method allow me to limit access based on their group membership?? if yes...could you briefly explain with an example?<br>










<br>Thank for your time in advance<br><font color="#888888">Shamika</font><div><div></div><div><br><br><br><div class="gmail_quote">On Wed, Dec 9, 2009 at 9:04 AM, Adam Hough <span dir="ltr">&lt;<a href="mailto:adam@gradientzero.com" target="_blank">adam@gradientzero.com</a>&gt;</span> wrote:<br>










<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><div>Here is is the write up that I read to figure out how to do setup to auto-restrict users to certain hosts. </div>










<div><br></div><a href="http://www.hurricanelabs.com/september2009_login_security_using_openldap_and_pam" target="_blank">http://www.hurricanelabs.com/september2009_login_security_using_openldap_and_pam</a><div><div></div>










<div><div>

<br></div><div><br>
</div></div></div></blockquote></div><br></div></div></blockquote></div><br>
</div></div></blockquote></div><br>
</div></div></blockquote></div><br>
</div></div></blockquote></div><br>
</blockquote></div><br>