Jonathan, That could be the root of the groups issue. I enabled the memberOf plugin after creating the groups and users. I will be testing in a few minutes. From: 389-users-bounces@xxxxxxxxxxxxxxxxxxxxxxx [mailto:389-users-bounces@xxxxxxxxxxxxxxxxxxxxxxx] On Behalf Of Jonathan Vaughn If you had your users and groups created before enabling memberOf, you'll need to modify their group membership (per user, easiest would be to add all to a temporary group then remove the group after memberOf populates) to trigger memberOf creation. It only gets set on changes, and won't autogenerate for existing memberships until a change occurs. It WILL regenerate all memberships even if you change just one, so you can just throw everyone into a group as I said to trigger it. There was a script in some FDS / 389DS howto someplace that was supposed to background trigger it, but I never got it to work. On Tue, Sep 3, 2013 at 3:47 PM, Andy <racingyacht1@xxxxxxxxx> wrote: Hi Rich, I had added the inetUser objectclass on the test cases of groups that failed. I was wondering if I had incorrectly configured arguments of the memberOf plugin. I will read the documentation again. I should be done rebuilding my instance of 389 in an hour or so. From: Rich Megginson [mailto:rmeggins@xxxxxxxxxx]
On 09/03/2013 01:22 PM, Andy wrote:
6.1.4.2. Object Classes Which Support memberof AttributesThe most common people object classes — such as Similarly, if an attribute other than I’m in the process of reconfiguring my instance of ldap, as it was misbehaving after I tried out various configuration to get roles and groups to work. From: Rich Megginson [mailto:rmeggins@xxxxxxxxxx] On 09/01/2013 05:50 AM, Andy wrote:
The default settings for OpenLDAP installations are:
From: Andy [mailto:racingyacht1@xxxxxxxxx] Hello I am testing integration of 389-ds with a blogging system. I plan to use roles instead of groups to automatically give users rights to service on the blog system. However, I am having problems with the system identifying members of roles. I need help with defining the correct search parameters to identify which roles a uid or cn is a member of. From within the blog system I’m using LDAPGroupFilter (objectclass=ldapSubEntry) to list the roles. The roles list correctly as groups within the blog system. From within 389 the members of roles are configured as filtered, and I can see the configured members using the Directory Server GUI. The blog system is not identifying members of roles when it does its search against 389. Note, users can log into the blog system using the accounts created on 389. I don’t think I am applying the correct search criteria to identify group membership. I need advice on creation of the correct search criteria for membership of roles/groups. Sample log from access [31/Aug/2013:11:09:39 +0100] conn=265 op=0 BIND dn="cn=Directory Manager" method=128 version=3 [31/Aug/2013:11:09:39 +0100] conn=265 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="cn=directory manager" [31/Aug/2013:11:09:39 +0100] conn=265 op=1 SRCH base="dc=xxxx,dc=com" scope=2 filter="(&(mail=testuser16@xxxxxxxx)(objectClass=*))" attrs="distinguishedName" [31/Aug/2013:11:09:39 +0100] conn=265 op=1 RESULT err=0 tag=101 nentries=1 etime=0 [31/Aug/2013:11:09:39 +0100] conn=265 op=2 BIND dn="uid=1000016,ou=Customers,dc=xxxx,dc=com" method=128 version=3 [31/Aug/2013:11:09:39 +0100] conn=265 op=2 RESULT err=0 tag=97 nentries=0 etime=0 dn="uid=1000016,ou=customers,dc=xxxx,dc=com" [31/Aug/2013:11:09:39 +0100] conn=265 op=3 BIND dn="cn=Directory Manager" method=128 version=3 [31/Aug/2013:11:09:39 +0100] conn=265 op=3 RESULT err=0 tag=97 nentries=0 etime=0 dn="cn=directory manager" [31/Aug/2013:11:09:39 +0100] conn=265 op=4 SRCH base="dc=xxxx,dc=com" scope=2 filter="(&(mail=testuser16@xxxxxxxx)(objectClass=*))" attrs="uid mail cn mail distinguishedName" [31/Aug/2013:11:09:39 +0100] conn=265 op=4 RESULT err=0 tag=101 nentries=1 etime=0 [31/Aug/2013:11:09:39 +0100] conn=265 op=5 SRCH base="dc=xxxx,dc=com" scope=2 filter="(|(uid=1000016))" attrs="nsRole" [31/Aug/2013:11:09:39 +0100] conn=265 op=5 RESULT err=0 tag=101 nentries=1 etime=0 [31/Aug/2013:11:09:39 +0100] conn=265 op=6 SRCH base="ou=customers,dc=xxxx,dc=com" scope=2 filter="(&(|(member=cn=xxxxrolecommentertest,ou=customers,dc=xxxx,dc=com))(objectClass=ldapSubEntry))" attrs="cn cn member nsUniqueId" [31/Aug/2013:11:09:39 +0100] conn=265 op=6 RESULT err=0 tag=101 nentries=0 etime=0 [31/Aug/2013:11:09:39 +0100] conn=265 op=7 UNBIND [31/Aug/2013:11:09:39 +0100] conn=265 op=7 fd=68 closed - U1 -- 389 users mailing list 389-users@xxxxxxxxxxxxxxxxxxxxxxx https://admin.fedoraproject.org/mailman/listinfo/389-users
|
-- 389 users mailing list 389-users@xxxxxxxxxxxxxxxxxxxxxxx https://admin.fedoraproject.org/mailman/listinfo/389-users
