Hi,

I'm trying to use dynlist overlay as dynamic group container.

system config: OS: debian lenny slapd: 2.4.11-1

slapd.conf [...] moduleload dynlist overlay dynlist dynlist-attrset groupOfNames labeledURI member

When I do a search like:

ldapsearch -x cn=ssh_admin I get:

# extended LDIF # # LDAPv3 # base <dc=domain,dc=com> (default) with scope subtree # filter: cn=ssh_admin # requesting: ALL #

# ssh_admin, Server, domain.com dn: cn=ssh_admin,ou=Server,dc=domain,dc=com objectClass: groupOfNames objectClass: labeledURIObject objectClass: top objectClass: posixGroup cn: ssh_admin member: uid=user1,ou=People,dc=domain,dc=com member: uid=user2,ou=People,dc=domain,dc=com labeledURI:ldap:///ou=People,dc=domain,dc=com??sub?(&(objectClass=posixAccount)) gidNumber: 30000

user1 is added manually, since at least one member attribute is required by groupOfNames (posixGroup is an auxiliary type)

And such a request: ldapsearch -x "(member=uid=user1,ou=People,dc=domain,dc=com)"

results in: # extended LDIF # # LDAPv3 # base <dc=domain,dc=com> (default) with scope subtree # filter: (member=uid=user1,ou=People,dc=domain,dc=com) # requesting: ALL #

# ssh_admin, Server, domain.com dn: cn=ssh_admin,ou=Server,dc=domain,dc=com objectClass: groupOfNames objectClass: labeledURIObject objectClass: top objectClass: posixGroup cn: ssh_admin member: uid=user1,ou=People,dc=domain,dc=com member: uid=user2,ou=People,dc=domain,dc=com labeledURI:ldap:///ou=People,dc=domain,dc=com??sub?(&(objectClass=posixAccount)) gidNumber: 30000

BUT with this one, which is a search done by a linux system when, e.g. doing id user2: ldapsearch -x "(member=uid=user2,ou=People,dc=domain,dc=com)"

I get: # extended LDIF # # LDAPv3 # base <dc=domain,dc=com> (default) with scope subtree # filter: (member=uid=user2,ou=People,dc=domain,dc=com) # requesting: ALL #

# search result search: 2 result: 0 Success

# numResponses: 1

My question is: how to make use of dynlist to get it working with a linux system, to automate group assignments. Or is there another way to do it?

The goal is to have a dynamic posixGroups generated upon some specified filters, as shown in the example, to manage the authorization to a service (for instance sshd).

Thanks for any suggestions and help.