Hi,

I'm not sure if this is exactly the right list, but I'm stuck trying to implement something at work and I'm hoping someone can help me.

Background:

We have an existing openldap setup that uses roles rather than groups to determine who gets what. We have people under ou=People, and roles under ou=Roles.

Here's parts of my person object:

dn: uid=apenney,ou=People,dc=law,dc=harvard,dc=edu objectClass: hostObject objectClass: inetOrgPerson objectClass: lawHarvardEduPerson objectClass: organizationalPerson objectClass: person objectClass: posixAccount objectClass: qmailUser objectClass: shadowAccount objectClass: top cn: Ashley Penney isMemberOf: cn=SFTP User:member,ou=Roles,dc=law,dc=harvard,dc=edu isMemberOf: cn=SFTPUser,ou=Roles,dc=law,dc=harvard,dc=edu

Here's cn=SFTPUser,ou=Roles

dn: cn=SFTPUser,ou=Roles,dc=law,dc=harvard,dc=edu objectClass: lawHarvardEduRole objectClass: organizationalUnit objectClass: posixGroup objectClass: top cn: SFTPUser gidNumber: 24 ou: Roles ou: Xythos description: Indicates that a user has SFTP access. displayName: SFTP User (SFTP User)

What I want to be able to do, via nss_ldap, is to interate over the isMemberOf entries, and check the cn=x,ou=roles for a posixGroup. I've managed to get it building a search of the form:

SRCHbase="ou=Roles,dc=law,dc=harvard,dc=edu" scope=2deref=3filter="(|distinguishedName=cn=sftpuser:member,ou=roles,dc=law,dc=harvard,dc=edu)(distinguishedName=cn=sftpuser,ou=roles,dc=law,dc=harvard,dc=edu))"

It then does a SRCHattr=objectClass lookup, but this fails. My understanding is this requires some support in openldap itself, and I can't figure out if this is provided or not.

So, my alternative method is to build a dynamic list up, from my understanding, and have it build me a dynamic sftp-users group. I cannot figure out what values I would map however, and I'd appreciate any assistance anyone can offer.