John A. Sullivan III
2008-Nov-21 03:13 UTC
[Fedora-directory-users] Dynamic groups not supplying posixgroup membership
Hello, all. We have a multi-tenant set up where each client has a group which contains all their internal users. We thought we would save time by creating a dynamic group using a filter such as: ldap:///ou=internal,ou=users,dc=X,dc=com,dc=ssiservices, dc=biz??sub?(&(objectclass=person)(uid=*)) This appears to work and adequately populates the group. However, when the user logs in to a Linux system, the Linux system queries for group membership. We are noticing that we do not get any results when using dynamic groups. If we make the same group managed, we see the group membership. Notice these two records from the access log (truncated because of screen scraping): filter="(&(objectClass=posixGroup)(|(memberUid=te.kee)(uniqueMember=uid=te.kee,ou=internal,ou=Users,dc=ebc-co,dc=com,dc=ssiservices,dcRESULT err=0 tag=101 nentries=1 etime=0 N.B. we have an entry. This used managed groups. When we change to dynamic groups, we see this: filter="(&(objectClass=posixGroup)(|(memberUid=te.kee)(uniqueMember=uid=te.kee,ou=internal,ou=Users,dc=ebc-co,dc=com,dc=ssiservices,dc RESULT err=0 tag=101 nentries=0 etime=0 N.B. no entries! Have we done something wrong? Is this a bug or is it the way it is supposed to work? Thanks - John -- John A. Sullivan III Open Source Development Corporation +1 207-985-7880 jsullivan@opensourcedevel.com http://www.spiritualoutreach.com Making Christianity intelligible to secular society
Jonathan Barber
2008-Nov-21 12:22 UTC
Re: [Fedora-directory-users] Dynamic groups not supplying posixgroup membership
On Thu, Nov 20, 2008 at 10:13:01PM -0500, John A. Sullivan III wrote:> Hello, all. We have a multi-tenant set up where each client has a group > which contains all their internal users. We thought we would save time > by creating a dynamic group using a filter such as: > > ldap:///ou=internal,ou=users,dc=X,dc=com,dc=ssiservices, > dc=biz??sub?(&(objectclass=person)(uid=*)) > > This appears to work and adequately populates the group. However, when > the user logs in to a Linux system, the Linux system queries for group > membership. We are noticing that we do not get any results when using > dynamic groups. If we make the same group managed, we see the group > membership. Notice these two records from the access log (truncated > because of screen scraping): > > filter="(&(objectClass=posixGroup)(|(memberUid=te.kee)(uniqueMember=uid=te.kee,ou=internal,ou=Users,dc=ebc-co,dc=com,dc=ssiservices,dc> RESULT err=0 tag=101 nentries=1 etime=0 > N.B. we have an entry. This used managed groups. > > When we change to dynamic groups, we see this: > filter="(&(objectClass=posixGroup)(|(memberUid=te.kee)(uniqueMember=uid=te.kee,ou=internal,ou=Users,dc=ebc-co,dc=com,dc=ssiservices,dc > RESULT err=0 tag=101 nentries=0 etime=0 > N.B. no entries! > > Have we done something wrong? Is this a bug or is it the way it is > supposed to work? Thanks - JohnDynamic groups just specifiy an LDAP filter which can be used to find which LDAP entries are members of the group. It doesn''t populate the attribute of the dynamic group entry with member entry DN''s. Try doing an ldapsearch for your group entry, and see what you get back, it won''t include an uniqueMember attributes (unless you''ve added some).> -- > John A. Sullivan III > Open Source Development Corporation > +1 207-985-7880 > jsullivan@opensourcedevel.com > > http://www.spiritualoutreach.com > Making Christianity intelligible to secular society > > -- > Fedora-directory-users mailing list > Fedora-directory-users@redhat.com > https://www.redhat.com/mailman/listinfo/fedora-directory-users-- Jonathan Barber High Performance Computing Analyst Tel. +44 (0) 1382 386389