RE: uniqueMember attribute is not suffixmassaged if attribute is not mapped and changed

["Mackey, Theral" <tmackey@zetta.net>]

I solved this on our setup with the following rewrite rules:
for bases dc=c,dc=b,dc=a   to   dc=b,dc=a


rewriteContext searchFilter
rewriteRule "(.*)memberUid=(.*)ou=people,dc=c,dc=b,dc=a(.*)" "%1memberUid=%2ou=people,dc=b,dc=a%3" ":"
rewriteContext searchResult
rewriteRule "(.*)memberUid=(.*)ou=people,dc=b,dc=a(.*)" "%1memberUid=%2ou=people,dc=c,dc=b,dc=a%3" ":"


This intercepts the queries of the group memberships and updates the DN, since the attributes are not of the DN type, thus do not get updated by the suffix massage, then intercepts the response and converts the DN back to what the querier is expecting (basically doing with suffix-massage does).

Change memberUid to whichever membership attr you are using, and the edit the base dns to your setup as well.
(yeh, this goes against the attr definition, but works in our 2307bis schema setup for posixGroup groups). 

-T


> Arvo Jari-Pekka wrote:
> > Hi.
> >
> > My configuration is like this:
> >
> > ---------
> >
> > database meta
> > suffix   "ou=a,dc=c,dc=b"
> >
> > uri           "ldap://host:port/ou=a,dc=c,dc=b";
> > suffixmassage "ou=a,dc=c,dc=b" "dc=a,dc=b"
> >
> > ...
> >
> > ---------
> >
> > This works fine in everything else but the uniqueMembers of
> groupOfUniqueNames gets not rewritten (they are still in dc=a,dc=b
> domain).
> >
> > If I however add a mapping
> >
> > ---------
> >
> > map             objectClass groupOfNames groupOfUniqueNames
> > map             attribute member uniqueMember
> >
> > ---------
> >
> > then the "member" attributes are correctly rewritten. The problem of
> course is that I do not want to change the objectclass.
> >
> > Mapping the attribute to itself does not help either. So
> >
> > ---------
> >
> > map objectClass groupOfUniqueNames *
> > map attribute uniqueMember *
> >
> > ---------
> >
> > does not have any effect.
> >
> > I must have missed something crucial on the documentation. Can
> someone please tell me what it is and how can I get uniqueMembers
> rewritten without changing the objectclass.
> >
> > OpenLDAP version is 2.4.11 for both the real and the meta server.
> 
> uniqueMember does not have DN syntax; only attributes with DN syntax
> are
> mapped.  You should have used groupOfNames/member instead of
> groupOfUniqueNames/uniqueMember.
> 
> p.