Re: [389-users] posixGroup

John A. Sullivan III
2009-05-21T13:46:13Z

On Thu, 2009-05-21 at 15:28 +0200, Michael Ströder
wrote:
> John A. Sullivan III wrote:
> > On Thu, 2009-05-21 at 18:07 +0600, Dmitry Amirov wrote:
> >> Hello.
> >>
> >> My question is simple. I need to create unix group. If i try to do
this
> >> via New->Group, then i can''t see posixGroup. So i can
add posixGroup
> >> only manually by adding needed attributes. But i want to add via
console
> >> such as i can add new user.
> > <snip>
> > If I correctly understand what you want, what I typically do is create
> > the group, click on Advanced and add the posixgroup attribute.  I then
> > simply add users who have previously had the posixAccount attribute
> > added to their definition.
>
> I think instead of "add attribute" you meant to say "add
auxiliary
> object class".
>
> But please note that the object classes groupOfNames/groupOfUniqueNames
> and posixGroup are all defined as STRUCTURAL. Strictly speaking in the
> spirit of LDAPv3 compliance an entry can only have exactly one
> STRUCTURAL object class (including the inherited STRUCTURAL object
> classes). Although the 389 DS does not prevent you from creating an
> entry like this
>
> objectClass: groupOfUniqueNames
> objectClass: posixGroup
>
> you shouldn''t do that since it might lead to interop problems.
>
> >  I also find in RedHat style systems that I
> > need to add the posixgroup attribute to the users.
>
> ???
>
> ''posixGroup'' is an auxiliary object class containing the
members'' ''uid''
> value in its multi-valued attribute ''memberUid''. Despite
the issues with
> STRUCTURAL I don''t see any reason to add this object class to a
person
> or account entry anyway.
>
> Ciao, Michael.
<snip>
Thanks very much for the clarification as I am (obviously) LDAP
ignorant.  Yes, I did mean add an objectclass.  Unfortunately, I think
we''re a bit stuck because of RedHat''s (useful) use of user
groups.
Since most of the user directory files are owned by a group with the
same name as the user, I have major issues if I do not do this.  I
suppose the correct solution would be to create a group of the same name
but then we hit potential problems with non-unique cn if we match uid
and cn and preserve uniqueness.  What do others do? Thanks - John
--
John A. Sullivan III
Open Source Development Corporation
+1 207-985-7880
jsullivan@opensourcedevel.com

http://www.spiritualoutreach.com
Making Christianity intelligible to secular society