That is interesting. I wonder if we are using a modified 00core.ldif then. I was unable to apply member attributes until I changed to the bis draft format. Will have to do a little more investigation. Thanks William. ________________________________________ From: William Brown <wibrown@xxxxxxxxxx> Sent: Tuesday, May 2, 2017 4:32 PM To: General discussion list for the 389 Directory server project. Subject: [389-users] Re: Search Filter by Group On Tue, 2017-05-02 at 16:38 +0000, Bassett.Mark wrote: > This is what the memberOf overlay is used for. However it doesn't work with posixGroup out of the gate, In order to use memberOf and posixGroup you need to use the draft bis schema. > > memberOf allows your user record to report group membership. > > Without it you must query the group directly for memberUid's. > > The bis draft schema should be available here: /usr/share/dirsrv/data/10rfc2307bis.ldif > > replace your 10rfc2307.ldif in /etc/dirsrv/schema/ and /etc/dirsrv/slapd-instance/schema > > Your groups should have objectclass groupOfNames > and then you can add users to groups using member: uid=$uid,ou=People,dc=example,dc=com > instead of memberuid: $uid. > > Then, when you query a user it will show its group membership with memberof attributes. Hey there, We ship groupOfNames in 00core.ldif with the following comment: # NOTE: There is one very important deviation from the LDAP standard: # there is a bug in the standard definition of groupOfNames and # groupOfUniqueNames - the member/uniqueMember attribute is in the MUST # list, not the MAY list, which means you cannot have an empty group. # Until the LDAP community figures out how to do grouping properly, we # have put the member/uniqueMember attribute into the MAY list, to allow # empty groups. So groupOfNames on a posixGroup, with member: dn, should "just work" out of the box. You only need to enable memberOf Plugin and run the fix up task to get everything in order. Hope that helps, -- Sincerely, William Brown Software Engineer Red Hat, Australia/Brisbane CONFIDENTIALITY NOTICE: This message is the property of International Game Technology PLC and/or its subsidiaries and may contain proprietary, confidential or trade secret information. This message is intended solely for the use of the addressee. If you are not the intended recipient and have received this message in error, please delete this message from your system. Any unauthorized reading, distribution, copying, or other use of this message or its attachments is strictly prohibited. _______________________________________________ 389-users mailing list -- 389-users@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to 389-users-leave@xxxxxxxxxxxxxxxxxxxxxxx
