Openldap + dynlist + posixGroup

Question

I have problem with OpenLdap and permission to file.

First - I set this in my slapd.conf:

overlay         dynlist
dynlist-attrset labeledURIObject labeledURI

Second - I make cn=test,ou=Projects,dc=example,dc=com with:

dn: cn=test,ou=Projects,dc=example,dc=com
gidNumber: 6789
objectClass: posixGroup
objectClass: top
objectClass: labeledURIObject
labeledURI: ldap:///cn=testgroup,ou=Groups,dc=example,dc=com?memberUid?sub?
(objectClass=posixGroup)
memberUid: user1 (dynamic)
memberUid: user2 (dynamic)

in cn=testgroup,ou=Groups,dc=example,dc=com i have memberuid: user1 and memberUid: user2

Third - when i made getent group test I have:

test:*:6789:user1,user2

But when I try id user1 i didn't see this group :(

And next I set chmod 770 dir and chown root.test dir and try access to this dir.

But of course it is not possible because the user is not in this group (that said "id").

Does anyone know the solution?

Answer 1

For the 3rd issue, the problem is that id will use a ldap request with (member=uid=login,... ) while getent group will search for the group ( cn=groupname ). So the 2nd one trigger the overlay , while the first don't ( see the man page ). I also faced the issue, and found some links about it : http://www.openldap.org/lists/openldap-software/200708/msg00250.html and http://www.openldap.org/lists/openldap-devel/200708/msg00127.html.

So far, I didn't found any good solution, maybe changing nss_ldap would work ( if you use it, which you didn't explained )

Answer 2

Third - when i made getent group test I have:

test:*:6789:user1,user2

But when i try id user1 i didn't see this group :(

Unfortunately dynamic lists (dynlists) are ONE WAY groups (not TWO way). This means that reverse lookups won't work, which causes the very issue you are now facing. There is no way to make reverse posix group lookups work with dynlist.

HOWEVER, there is another module available somewhere on OpenLDAP's site I believe. It is called autogroup. This is a static-group maintainer module. This method of grouping does not involved dynamic data, rather it is REAL data that is automagically managed by the autogroup module. However, it is configured similar to a dynlist group as it uses the labeledURI attribute to allow a "stored procedure" so to speak.

I too was disappointed when I realized the shortcomings of dynlist, and I should point out that autogroup is still somewhat experimental. Test thoroughly and report any bugs to OpenLDAP.

I hope this helps...

Max

Answer 3

Groups are constructed here in this way without memberUid, but member:

dn: cn=mygroup,ou=groups,o=company
objectClass: posixGroup
objectClass: top
objectClass: groupOfNames
cn: mygroup
member: uid=user1,ou=users,o=company
displayName: mygroup
gidNumber: 1234

The schema type is also to be set to RFC2307bis (ldap_schema = rfc2307bis in sssd.conf).