Re: slapo-memberof Usage

[Buchan Milne <bgmilne@staff.telkomsa.net>]

On Wednesday, 5 May 2010 14:31:01 Stuart Cherrington wrote:
> Hello again,
> 
> Having successfully upgraded my LDAP install to 2.4.22 on Redhat 5.3 I've
>  been looking at use of the 'slapo-memberof' schema as provided by
>  openldap2.4-server package.
> 
> The man page for slapo-memberof2.4 indicates I can use the 'memberof-dn'
>  directive.

This relates to it being used in your slapd configuration. However, the man 
page is quite clear in that this directive isn't *that* useful (only affects 
operational attributes).

> So, I've updated my slapd.conf file to allow the 'moduleload     
>  memberof.la' to be used and restarted ldap2.4 services.

That is not sufficient, you would at least need:
overlay memberof

in the affected database. Additionally, note that the overlay only maintains 
the memberof attribute for *changes* to the member (or attribute specified by 
memberof-member-ad) attribute, the initial population is up to you (or, you 
could probably send trivial modifications to all your groupOfNames entries to 
force the overlay to update the attributes.

>  On the client I
>  have configured my ldap.conf without the memberof directive and it works
>  fine, but when I use memberof I can no longer login.
> 
> nss_base_passwd                ou=people,dc=ldn,dc=sw,dc=com
> Works fine
> 
> nss_base_passwd        
>  ou=people,dc=ldn,dc=sw,dc=com?sub?memberof-dn=cn=access,ou=auth,dc=ldn,dc=
> sw,dc=com Fails to log me in.

Firstly, you should be using memberof=DN, not memberof-dn=DN, secondly, does 
your user have a matching attribute?


> I can see the people and auth OU's from the client using ldapsearch.

But,  do these people have correct memberof attributes?

> 
> Questions:
> What is the correct syntax for using the memberof-dn directive?

This is probably irrelevant.

> If the client does NOT have the openldap2.4-server package installed, does
>  it pass the 'memberof-dn' directive to my LDAP server to be parsed?

Please consult the nss_ldap documentation for nss_base_passwd, but, typically, 
it should use the value you have supplied as a filter to a search operation. 
Have you manually verified that the accounts you expect to be matched by your 
filter do, in fact, match the filter? For example, by using:

$ ldapsearch -x -b ou=people,dc=ldn,dc=sw,dc=com "(memberof-
dn=cn=access,ou=auth,dc=ldn,dc=sw,dc=com)"

Note: I copied from your configuration, if your configuration is wrong, fix it, 
and re-paste the filter, to make sure you are testing what you have configured 
....


Regards,
Buchan