On Tue, 2017-05-02 at 16:38 +0000, Bassett.Mark wrote: > This is what the memberOf overlay is used for. However it doesn't work with posixGroup out of the gate, In order to use memberOf and posixGroup you need to use the draft bis schema. > > memberOf allows your user record to report group membership. > > Without it you must query the group directly for memberUid's. > > The bis draft schema should be available here: /usr/share/dirsrv/data/10rfc2307bis.ldif > > replace your 10rfc2307.ldif in /etc/dirsrv/schema/ and /etc/dirsrv/slapd-instance/schema > > Your groups should have objectclass groupOfNames > and then you can add users to groups using member: uid=$uid,ou=People,dc=example,dc=com > instead of memberuid: $uid. > > Then, when you query a user it will show its group membership with memberof attributes. Hey there, We ship groupOfNames in 00core.ldif with the following comment: # NOTE: There is one very important deviation from the LDAP standard: # there is a bug in the standard definition of groupOfNames and # groupOfUniqueNames - the member/uniqueMember attribute is in the MUST # list, not the MAY list, which means you cannot have an empty group. # Until the LDAP community figures out how to do grouping properly, we # have put the member/uniqueMember attribute into the MAY list, to allow # empty groups. So groupOfNames on a posixGroup, with member: dn, should "just work" out of the box. You only need to enable memberOf Plugin and run the fix up task to get everything in order. Hope that helps, -- Sincerely, William Brown Software Engineer Red Hat, Australia/Brisbane
Attachment:
signature.asc
Description: This is a digitally signed message part
_______________________________________________ 389-users mailing list -- 389-users@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to 389-users-leave@xxxxxxxxxxxxxxxxxxxxxxx
