Hi Rich,
ops! my bad. Thank you so much for pointing that out. Now I could see
MemberOf attribute in my user entries.
Thanks again!
--Chandan
On Friday, March 22, 2013, Rich Megginson wrote:
On 03/22/2013 11:06 AM, Chandan Kumar wrote:
Hello,
So far I have been managed to do some setup of 389 server, thanks to
prompt community.
Now, I am having some trouble in getting the MemberOf plugin work
for 389-ds-base-1.2.11.15-11. When I add a user into a group, the memberOf
attribute is not being added to the user entry.
While googling a bit I came across an older post of this group
http://www.redhat.com/archives/fedora-directory-users/2009-December/msg00...
based on that, I checked dse.ldif and the Plugin configuration also
looks good.
Too bad that google didn't send you here:
https://access.redhat.com/knowledge/docs/en-US/Red_Hat_Directory_Server/9...
Specifically:
"6.1.4.2. Object Classes Which Support memberof Attributes
The most common people object classes — such as inetorgperson and person —
do not allow the memberOf attribute. To allow the MemberOf Plug-in to add
the memberOf attribute to a user entry, make sure that that entry belongs
to the inetUser object class, which does allow the memberOf attribute."
Even in the link you posted:
" objectClass: shadowaccount
objectClass: inetuser
physicalDeliveryOfficeName: Kennebunk
...
"
dn: cn=MemberOf Plugin,cn=plugins,cn=config
objectClass: top
objectClass: nsSlapdPlugin
objectClass: extensibleObject
cn: MemberOf Plugin
nsslapd-pluginPath: libmemberof-plugin
nsslapd-pluginInitfunc: memberof_postop_init
nsslapd-pluginType: postoperation
nsslapd-pluginEnabled: on
nsslapd-plugin-depends-on-type: database
memberofgroupattr: uniqueMember
memberofattr: memberOf
nsslapd-pluginId: memberof
nsslapd-pluginVersion: 1.2.11.15
nsslapd-pluginVendor: 389 Project
nsslapd-pluginDescription: memberof plugin
modifiersName: cn=directory manager
modifyTimestamp: 20130322162350Z
The way I am adding users :
dn: uid=chandank,ou=People,dc=ma,dc=net
objectclass: person
objectclass: inetorgperson
objectclass: posixAccount
cn: Chandan
sn: k
givenName: chandank
uid:chandank
uidNumber:5006
gidNumber:5006
objectclass: mepOriginEntry
mepManagedEntry: cn=chandank
homeDirectory: /home/chandank
loginShell: /bin/bash
The way I am adding them into a group:
dn: cn=sys,ou=Groups,dc=ma,dc=net
changetype: modify
add: uniqueMember
uniqueMember: uid=chandank,ou=People,dc=ma,dc=net
And after I have added the user I am expecting an MemberOf attribute
entry in the user entry itself. I am not sure whether it is the right way
to do so.
For the records: Having MemberOf attribute in the user entry would allow
me use ldap Access filters in sssd.conf file eg.
"ldap_access_filter =
memberOf=cn=allowedusers,ou=Groups,dc=example,dc=com" and hence will be
able to restrict users from login on different systems.
Thanks
Chandan
--
--
http://about.me/chandank
--
389 users mailing list389-users(a)lists.fedoraproject.org <javascript:_e({},
'cvml',
'389-users@lists.fedoraproject.org');>https://admin.fedoraproject.org/mailman/listinfo/389-users