[Date Prev][Date Next]
[Chronological]
[Thread]
[Top]
Re: openldap rewrite 2307 group attribute
On Tue, 07 Dec 2004 22:40:25 -0800, Howard Chu <hyc@symas.com> wrote:
> Tyson Lambert wrote:
>
>
>
> >Hello,
> >
> >I'm trying to translate an attribute in active directory to one I can
> >use with my unix boxen. Right now I'm using attribute mappings in
> >much the same fasion as padl's nss_ldap module which is working great
> >except for the posix group attribute. My AD server stores unix groups
> >like so in an object class
> >
> >Group:
> >
> > msSFU30PosixMember=CN=nixuser,CN=Users,DC=circus,DC=test,DC=com
> > msSFU30PosixMember=CN=nixuser2,CN=Users,DC=circus,DC=test,DC=com
> > msSFU30PosixMember=CN=turkey,CN=Users,DC=circus,DC=test,DC=com
> >
> >What I need is:
> >
> >posixGroup:
> >
> > memberuid=nixuser
> > memberuid=nixuser2
> > memberuid=turkey
> >
> >
> No, what you need is to recompile your nss_ldap with support for
> RFC2307bis, which uses DN-valued members for posixGroup.
> And of course, further discussion of this topic belongs on the nss_ldap
> mailing list, it has nothing to do with OpenLDAP software.
I'm only using the padl nss_ldap modules on the linux platforms and
aix 5.1 (due to lack of a native ldap client with 2307 support). On
all of the other platforms it's neccessary to use the native ldap
clients. So far so good except for the group issue. I'm going to
look into 2307bis on the various platforms though and see where that
takes me.
Meanwhile.. how would one hypothetically do this with a rewrite?
-Tyson
> --
> -- Howard Chu
> Chief Architect, Symas Corp. Director, Highland Sun
> http://www.symas.com http://highlandsun.com/hyc
> Symas: Premier OpenSource Development and Support
>
>