Am 03.01.22 um 18:19 schrieb Quanah Gibson-Mount:
--On Monday, January 3, 2022 6:14 PM +0100 Michael Ströder michael@stroeder.com wrote:
On 1/3/22 18:03, Quanah Gibson-Mount wrote:
In general, "memberUID" is for use with posix groups (NOT LDAP groups). But again, it's generally deficient since it cannot discern between two different entries with the same UID. I.e.:
dn: uid=joe,ou=employees,dc=example,dc=com uid: joe
dn: uid=joe,ou=students,dc=example,dc=com uid: joe
But slapo-unique could be used to enforce uniqueness of 'uid' attribute.
It could, but it still doesn't fix the fact that *LDAP* groups are made up of DNs, not random attribute:value pairs.
--Quanah
That's why I build my own objectClass for possixAccount and PosixGroup: --------------- dn: cn=stkaPosixExtension,cn=schema,cn=config objectClass: olcSchemaConfig cn: stkaPosixExtension olcObjectClasses: ( 1.3.6.1.4.1.56860.1.2.1 NAME 'stkaPosixGroup' DESC 'advanced PosixGroup for dynamic use' SUP top AUXILIARY MUST ( cn $ gidNumber ) MAY ( userPassword $ memberUid $ description ) ) olcObjectClasses: ( 1.3.6.1.4.1.56860.1.2.2 NAME 'stkaPosixAccount' DESC 'advanced PosixAccount for dynamic use' SUP posixAccount AUXILIARY MAY ( memberUID ) )
--------------- I can see the group with "getent groups" I use sssd on the client with the following domain configuration: -------------- [domain/EXAMPLE] ldap_schema=rfc2307 ldap_uri = ldap_search_base=dc=example,dc=net id_provider=ldap auth_provider=krb5 chpass_provider = krb5 krb5_realm = EXAMPLE.NET dns_discovery_domain = EXAMPLE.NET krb5_server = ldap_sasl_mech =GSSAPI ldap_sasl_authid = sssd-user ldap_krb5_keytab = /etc/sssd/sssd-user.keytab ldap_chpass_uri = ldap://ldap01.example.net:389 cache_credentials = True ldap_tls_cacertdir = /etc/ssl/zertifikate/demoCA ldap_tls_cacert = /etc/ssl/zertifikate/demoCA/cacert.pem ldap_id_use_start_tls = True enumerate = TRUE ldap_group_object_class = PosixGroup ldap_group_object_class_alt = stkaPosixGroup
--------------
The parameter "enumerate = TRUE" is for testing only
I see the group with "getent group" but the strange thing is, sometimes with all members and sometimes with an empty memberlist.
--
Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: http://www.symas.com