Hi all,<div><br></div><div>Am trying to get the memberOf overlay attribute working with openLDAP.</div><div><br></div><div>I need to authenticate to a Cisco ASA 5510 and set up group mapping policy.</div><div><br></div><div>
I&#39;ve been round the houses quite a few times and got pretty close but no Marlboro Light (let alone a cigar).</div><div><br></div><div>My slapd.conf looks like this:</div><div><br></div><div># /etc/ldap/slapd.conf</div>
<div><div>#</div><div><br></div><div># Schema and objectClass definitions</div><div>include         /etc/ldap/schema/core.schema</div><div>include         /etc/ldap/schema/cosine.schema</div><div>include         /etc/ldap/schema/nis.schema</div>
<div>include         /etc/ldap/schema/inetorgperson.schema</div><div>include         /etc/ldap/schema/samba.schema</div><div>include         /etc/ldap/schema/misc.schema</div><div><br></div><div>pidfile         /var/run/slapd/slapd.pid</div>
<div><br></div><div>argsfile        /var/run/slapd/slapd.args</div><div><br></div><div>modulepath      /usr/lib/ldap</div><div><br></div><div>moduleload      back_bdb</div><div><br></div><div>#syncprov added by PT 2009-01-19</div>
<div>moduleload      syncprov</div><div><br></div><div># cja/ess/2010.03.29 - added memberOf overlay</div><div>moduleload <a href="http://memberof.la">memberof.la</a></div><div>overlay memberof</div><div><br></div><div>sizelimit 500</div>
<div><br></div><div>tool-threads 1</div><div><br></div><div>backend         bdb</div><div><br></div><div>database        bdb</div><div><br></div><div>suffix          &quot;dc=essence&quot;</div><div><br></div><div>rootdn          &quot;cn=admin,dc=essence&quot;</div>
<div>rootpw  xxxxxxxxxxxxxxxxxxxxxxx</div><div><br></div><div>directory       &quot;/var/lib/ldap&quot;</div><div><br></div><div>dbconfig set_cachesize 0 2097152 0</div><div><br></div><div>dbconfig set_lk_max_objects 1500</div>
<div>dbconfig set_lk_max_locks 1500</div><div>dbconfig set_lk_max_lockers 1500</div><div><br></div><div>index           objectClass,entryCSN,entryUUID eq</div><div><br></div><div>lastmod         on</div><div><br></div><div>
checkpoint      512 30</div><div><br></div><div>replogfile      /var/lib/ldap/replog</div><div><br></div><div>#syncprov added by PT 2009-01-19</div><div>overlay syncprov</div><div>syncprov-checkpoint 10 5</div><div>syncprov-sessionlog 100</div>
<div><br></div><div><div>access to attrs=userPassword,sambaNTPassword,sambaLMPassword</div><div>        by dn=&quot;cn=admin,dc=essence&quot; write</div><div>        by dn=&quot;cn=samba,dc=essence&quot; write</div><div>        by dn=&quot;cn=guest,dc=essence&quot; read</div>
<div>        by anonymous auth</div><div>        by self write</div><div>        by * none</div><div><br></div><div>access to dn.base=&quot;&quot; by * read</div><div><br></div><div>access to *</div><div>        by dn=&quot;cn=admin,dc=essence&quot; write</div>
<div>        by dn=&quot;cn=samba,dc=essence&quot; write</div><div>        by * read</div><div><br></div><div># end</div><div><br></div><div>I&#39;ve added an LDIF as follows:</div><div><br></div><div><div>dn: cn=vpnusers,ou=Groups,dc=essence</div>
<div>objectclass: groupOfNames</div><div>cn: vpnusers</div><div>member: userid=chris.alavoine,ou=Users,dc=essence</div><div><br></div><div>Which seems to enter ok. </div><div><br></div><div>I&#39;m using phpldapadmin to look at my directory. The new group &quot;vpnusers&quot; shows up ok and if I do a:</div>
<div><br></div><div>ldapsearch -x -b &quot;dc=essence&quot; &#39;(uid=chris.alavoine)&#39; memberOf</div><div><br></div><div>I get:</div><div><br></div><div><div># chris.alavoine, Users, essence</div><div>dn: uid=chris.alavoine,ou=Users,dc=essence</div>
<div>memberOf: cn=vpnusers,ou=Groups,dc=essence</div><div><br></div><div>Unfortunately, when I try and query this information from the Cisco it&#39;s not picking up on the memberOf attribute. I&#39;ve set up attribute mapping on the Cisco which allows me to convert the memberOf attribute into something readable by the Cisco but it&#39;s not getting that far.</div>
<div><br></div><div>I&#39;m using Ubuntu 8.04 and openLDAP 2.4.9</div><div><br></div><div>Any help much appreciated.</div><div><br></div><div>c:)</div></div></div></div></div><div><br clear="all"><br>-- <br>ACS (Alavoine Computer Services)<br>
Chris Alavoine<br>mob +44 (0)7724 710 730<br><a href="http://www.alavoinecs.co.uk">www.alavoinecs.co.uk</a><br>
</div>