[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: two issues with dyngroups

Guillaume Rousse wrote:
Hello list.

I'm an happy users of dynlist overlay, in order to make my unix users members of their unix primary group:

# admins, groups, msr-inria.inria.fr
dn: cn=admins,ou=groups,dc=msr-inria,dc=inria,dc=fr
objectClass: groupOfURLs
objectClass: posixGroup
gidNumber: 5000
memberURL: ldap:///ou=users,dc=msr-inria,dc=inria,dc=fr??sub?(gidNumber=5000)
cn: admins

With this configuration:
# dynamic groups
overlay dynlist
dynlist-attrset groupOfURLs memberURL member

However, I'm facing two issues here.

The first is that dynlist overlay only accept a single configuration directive for the whole base, preventing to map differently the request URL depending on the context. In my previous example, I need to map the URL as DN, because I'm dynamically building a group from users. If I wanted to build a group from other group, my URL would have been something as:

and the configuration directive would have been instead
dynlist-attrset groupOfURLs memberURL

It would be nice to handle the overlay differently there.

The second directive is that ACLs seems to ignore this dynamic group:
# admins
access to dn.subtree="dc=msr-inria,dc=inria,dc=fr"
    by group="cn=admins,ou=groups,dc=msr-inria,dc=inria,dc=fr" write
    by * break


access to dn.subtree="dc=msr-inria,dc=inria,dc=fr"
     by group/groupOfURLs/memberURL="cn=admins,ou=groups,dc=msr-inria,dc=inria,dc=fr" write
     by * break

(please excuse any unintended line wrapping).

This worked with a static group, it doesn't work anymore with a dynamic one as I just presented.

I'm using OpenLDAP 2.4.11. Should I open ITS for those issues ?

Issue #2 should be fixed by the above rule. I suggest you file a request for enhancement for issue #1, consisting in adding an (optional) URI to each dynlist-attrset that allows to restrict the application of the attrset to selected dynamic group entries matching the base, scope and filter of the URI (if present).

The configuration would become something like

dynlist-attrset <group-oc> <URL-ad>
        [ ldap:///base??scope?filter ]
        [[<mapped-ad>:]<member-ad> ...]

and, in your case, you would need something like

overlay dynlist
dynlist-attrset groupOfURLs memberURL
dynlist-attrset groupOfURLs memberURL


Ing. Pierangelo Masarati
OpenLDAP Core Team

SysNet s.r.l.
via Dossi, 8 - 27100 Pavia - ITALIA
Office:  +39 02 23998309
Mobile:  +39 333 4963172
Fax:     +39 0382 476497
Email:   ando@sys-net.it