Thanks.  Yes, very helpful.

For the group that lists our accounts I now have full DN

dn: cn=admins,ou=group,dc=server,dc=domain
objectClass: posixGroup
objectClass: top
cn: admins
memberUid: uid=user,ou=accounts,dc=server,dc=domain

slapd.conf:

limits group/posixGroup/memberUid="cn=admins,ou=group,dc=server,dc=domain" size=unlimited time=unlimited

Though I am still hitting the limit. 



Thanks,

Douglas Duckworth, MSc, LFCS
HPC System Administrator
Scientific Computing Unit
Physiology and Biophysics
Weill Cornell Medicine
E: doug@med.cornell.edu
O: 212-746-6305
F: 212-746-8690

On Wed, Jul 19, 2017 at 6:25 PM, Quanah Gibson-Mount <quanah@symas.com> wrote:
--On Tuesday, July 18, 2017 4:32 PM -0400 Douglas Duckworth
<dod2014@med.cornell.edu> wrote:

># admins, group, ldap.server
> dn: cn=admins,dc=blah
> objectClass: posixGroup
> objectClass: top
> cn: admins
> memberUid: admin1
> memberUid: admin2
>
> Do you have any insight into what could be causing this behavior?  I
> have not found the answer yet through extensive searching of the
> internets.

Hi Douglas,

The answer lies in the slapd.conf(5) man page, in the description of the
"limits" directive, specifically in this portion:

"sets the limits for any DN listed in the values of  the  at  attribute"

memberUID does not contain a DN, therefore it cannot be used.  Hope that
helps!

Regards,
Quanah

--

Quanah Gibson-Mount
Product Architect
Symas Corporation
Packaged, certified, and supported LDAP solutions powered by OpenLDAP:
<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.symas.com&d=DwIFaQ&c=lb62iw4YL4RFalcE2hQUQealT9-RXrryqt9KZX2qu2s&r=2Fzhh_78OGspKQpl_e-CbhH6xUjnRkaqPFUS2wTJ2cw&m=91FmzFy5LT0oV9_Olhg0-lXej0TEADB8w4Tft72zqXs&s=rnsVibsarNFQ1327v29L487KiPFGapoLz4PZ55l7Hsc&e= >