docker-openldap: memberOf with groupOfUniqueNames not working

It seems from the comments on https://github.com/osixia/docker-openldap/issues/49 that memberOf is included in this docker image and should be working as long as the group is of objectClass: groupOfUniqueNames and if each member of the group is a uniqueMember.
Is this right?

I am not getting any memberOf info when I search.

Here is an example of an LDIF to add a group and member: dn: cn=admin,ou=groups,dc=example,dc=com objectClass: groupofuniquenames cn: admin description: Admin users uniquemember: uid=john,ou=users,dc=example,dc=com

Here is an example of how I’m searching: ldapsearch -x -D cn=admin,dc=example,dc=com -w admin -b dc=example,dc=com -h 127.0.0.1 uid=john memberOf

The output is just: dn: cn=john,ou=users,dc=example,dc=com but I’d expect it to be: dn: cn=john,ou=users,dc=example,dc=com memberOf: cn=admin,ou=groups,dc=example,dc=com

Should this be working or am I doing something wrong?

About this issue

Original URL
State: open
Created 5 years ago
Comments: 59 (8 by maintainers)

Most upvoted comments

@encryptblockr

I’ve done the following:

a) Load the memberof configuration as provided by Osixia:

ldapmodify -x -H ldap:// -D cn=config -w secret -f ./memberof.ldif
modifying entry "cn=module{0},cn=config"

adding new entry "olcOverlay={0}memberof,olcDatabase={1}mdb,cn=config"

b) Load your database:

ldapadd -x -H ldap:// -D dc=example,dc=com -w secret -f ./exampledb.ldif

adding new entry "ou=groups,dc=ldap,dc=example,dc=com"

adding new entry "cn=finance,ou=groups,dc=ldap,dc=example,dc=com"

adding new entry "cn=engineering,ou=groups,dc=ldap,dc=example,dc=com"

adding new entry "ou=users,dc=ldap,dc=example,dc=com"

adding new entry "cn=Johnathan Jordan,ou=users,dc=ldap,dc=example,dc=com"

adding new entry "cn=Brandon Britton,ou=users,dc=ldap,dc=example,dc=com"

Now, this fails to generate memberOf because you created the users after you created the groups. This is one of the distinct failings of memberOf in its current form – Users must exist in the database prior to them being added to a group for the overlay to work.

Now if I modify the groups:

ldapmodify -x -H ldap:// -D dc=example,dc=com -w secret
dn: cn=finance,ou=groups,dc=ldap,dc=example,dc=com
changetype: modify
replace: uniqueMember
uniqueMember: cn=Johnathan Jordan,ou=users,dc=ldap,dc=example,dc=com
uniqueMember: cn=Brandon Britton,ou=users,dc=ldap,dc=example,dc=com

modifying entry "cn=finance,ou=groups,dc=ldap,dc=example,dc=com"

dn: cn=engineering,ou=groups,dc=ldap,dc=example,dc=com
changetype: modify
replace: uniqueMember
uniqueMember: cn=Johnathan Jordan,ou=users,dc=ldap,dc=example,dc=com

modifying entry "cn=engineering,ou=groups,dc=ldap,dc=example,dc=com"

The memberOf attribute is correctly created:

ldapsearch -x -LLL -H ldap:// -D dc=example,dc=com -w secret -b dc=ldap,dc=example,dc=com "cn=Brandon Britton" memberOf
dn: cn=Brandon Britton,ou=users,dc=ldap,dc=example,dc=com
memberOf: cn=finance,ou=groups,dc=ldap,dc=example,dc=com

ldapsearch -x -LLL -H ldap:// -D dc=example,dc=com -w secret -b dc=ldap,dc=example,dc=com "cn=Johnathan Jordan" memberOf
dn: cn=Johnathan Jordan,ou=users,dc=ldap,dc=example,dc=com
memberOf: cn=finance,ou=groups,dc=ldap,dc=example,dc=com
memberOf: cn=engineering,ou=groups,dc=ldap,dc=example,dc=com

+10

quanah on Dec 13, 2019

@encryptblockr We get a lot of unhappy users of Osixia who come to the OpenLDAP project email lists complaining, so I do my best to keep them off the list by answering questions here as much as I can since the OpenLDAP project has no links to Osixia.

quanah on Dec 5, 2019

@obourdon I can confirm that “memberOf” only works for groupOfUniqueNames and not for groupOfNames. Which log output do you need to investigate this problem?

drhuh on Jun 13, 2019

per the configuration, it is supposed to work with groupOfUniqueNames

https://github.com/osixia/docker-openldap/blob/stable/image/service/slapd/assets/config/bootstrap/ldif/03-memberOf.ldif

quanah on Apr 18, 2019

you dont use Osixia docker but you in the issue responding to questions? i dont think it takes more than 5 minutes to have one up…just incase you plan to use it ever

encryptblockr on Dec 5, 2019

memberOf is a custom system developed by Microsoft that has no defined specification and as is currently implemented, is entirely unsafe to use with replication. I personally avoid using memberOf entirely.

quanah on Dec 5, 2019

@vityafx no problem and many thanks for your answer. Hopefully this now seem to work for you. Will still dig into this later on to see if I can find something worth mentioning

obourdon on Apr 11, 2019