Re: Group membership question : New to OpenLDAP

[Peter Marschall <peter@adpm.de>]

Hi,

On Saturday 15 November 2003 05:24, Sachin C wrote:
> I have a situation where i want to find out who are
> the members of a group and vice versa i.e. a user is
> member of which group.
>
> I have used AD 2003. It gives a nice facility that
> whenever we set a user as "member" of a group (or set
> member attrib of user) then automatically the memberOf
> attribute os the user object is set to proper value
> (i.e. DN of the group).
>
> Is there any such facility present in OpenLDAP. I am
> new to OpenLDAP. Please help.

OpenLDAP does not support that kind of backlink.
It is a private extension to the LDAP standard that some directroy servers 
provide and thus is not portable (the attribute names for the group 
membership in the user's object differ from vendor to vendor).

To be truly portable you can revert the logic: 
Instead of doing an unportable

  ldapsearch -b USER -s base '(objectclass=*)'  memberOf

do a

  ldapsearch -b GROUPS-CONTAINER -s sub '(member=USER)' 1.1

where USER is the DN of the user and GROUPSCONTAINER is the DN of the branch 
that contains all groups.

Peter

-- 
Peter Marschall
eMail: peter@adpm.de