I need to get all memberships of users from groupofuniquenames typed entry that has membership data in uniqueMember attribute. Groups look like this:
dn: cn=GROUP1,ou=groups,dc=zxc
objectclass: groupofuniquenames
uniqueMember: uid=1252611,ou=users,dc=zxc
uniqueMember: uid=23893,ou=users,dc=zxc
uniqueMember: uid=95044,ou=users,dc=zxc
uniqueMember: uid=127121,ou=users,dc=zxc
dn: cn=GROUP2,ou=groups,dc=zxc
objectclass: groupofuniquenames
uniqueMember: uid=1252611,ou=users,dc=zxc
uniqueMember: uid=589454,ou=users,dc=zxc
uniqueMember: uid=34848,ou=users,dc=zxc
uniqueMember: uid=1252612,ou=users,dc=zxc
However if i use filter like this
(&(objectclass=groupOfUniqueNames)(|(uniqueMember=uid=1252611,ou=users,dc=zxc)(uniqueMember=uid=1252612,ou=users,dc=zxc)))
I get results like this
dn: cn=GROUP1,ou=groups,dc=zxc
objectclass: groupofuniquenames
uniqueMember: uid=1252611,ou=users,dc=zxc
cn: GROUP1
dn: cn=GROUP2,ou=groups,dc=zxc
objectclass: groupofuniquenames
uniqueMember: uid=1252611,ou=users,dc=zxc
cn: GROUP2
So the search results do not contain info that 1252612 is also member of GROUP2. They only return results for one match for the OR condition in LDAP search filter. So the problem is caused because users in the filter query can belong to same groups, but the group result is returned only for one user.
I also don't understand why the returned uniqueMember attribute doesn't contain data for all memberships, if this is possible to achieve it would also be helpful.
Related
As I konw, LDAP have four objectClass to represent the organization
groupOfUniqueNames
groupOfNames
organizationalUnit
posixGroup
And It have four objectClass to represent people
posixAccount
shadowAccount
organizationalPerson
inetOrgPerson
This is where I am confused. In general, which objectClass should be used to organize the relationship between departments and personnel? In My LDAP Server
I am trying to do this example with an email field :
https://coderwall.com/p/c0w6-q/create-ldap-aliases-in-openldap
This is the .ldif that should create both :
# this is the user
dn: uid=aka,c=VN,ou=users,ou=school,o=vdm,dc=domain,dc=com
objectclass: top
objectClass: extensibleObject
objectclass: posixAccount
objectclass: inetOrgPerson
cn: Alexander Fake
employeetype: developer
gecos: Alexander Fake
gidnumber: 14564103
homedirectory: /home/aka
loginshell: /bin/bash
mail: alexander.fake#domain.com
sn: Fake
uid: aka
uidnumber: 14583105
userpassword: {SSHA}SgmdndrPR5UVLOAmDs5JOJvqr3WmPYob
# this is the alias
dn: mail=alexander.Fake#domain.com,dc=mailAccount,dc=domain.com,dc=mail,dc=domain,dc=com
changetype: add
objectClass: alias
objectClass: top
objectClass: extensibleObject
objectclass: inetOrgPerson
uid: aka
aliasedObjectName: uid=aka,c=VN,ou=users,ou=school,o=vdm,dc=domain,dc=com
I can only import/export ldif, I use phpldapadmin for administration.
When the aliases is craeted it produce the following error :
This update has been or will be cancelled, it would result in an attribute value not being unique. You might like to search the LDAP server for the offending entry.
Does anyone know how to create aliases on openldap and phpldapadmin ?
This is basically correct. Just:
Remove the uid=aka attribute from the aliasedObject. It doesn't need it. It refers to another object which has that UID value.
Also remove inetOrgPerson from the alias. It isn't a person, it's an alias for a person.
The objectClass attribute only needs to contain top and alias; and extensibleObject so you can provide a cn or whatever attribute you like as part of the DN, if you want to do that: it doesn't seem to be necessary judging by my DIT.
Poor quality source material. Don't rely on arbitrary Internet junk. Use the official documentation.
I am trying to modify uid value in Tivoli directory server using API. Please review the below user structure.
dn: uid=user1,cn=demo,o=evault
uid: user1
userPassword: {AES256}mIJFA1UiEMYP6J2dVt3vcg==
objectclass: top
objectclass: demoObjectClass
objectclass: ePerson
objectclass: inetOrgPerson
objectclass: organizationalPerson
objectclass: person
sn: user1
cn: user1
ibm-entryuuid: 134f18c0-b251-1034-8575-a2f4cc94f892
Here i am trying yo change the uid. Is it possible?? Please guide me on this
You must perform a rename on the entry as uid is the "naming attribute".
I am trying to simulate Active Directory's memberOf attribute in Apache Directory. I have added the following entry for memberOf to my LDIF file:
dn: m-oid=1.3.6.1.4.1.18060.0.4.3.2.1,ou=attributeTypes,cn=other,ou=schema
m-usage: USER_APPLICATIONS
m-equality: distinguishedNameMatch
objectClass: metaAttributeType
objectClass: metaTop
objectClass: top
m-name: memberOf
m-oid: 1.3.6.1.4.1.18060.0.4.3.2.1
m-obsolete: FALSE
m-noUserModification: FALSE
m-syntax: 1.3.6.1.4.1.1466.115.121.1.27
When I start ApacheDS the following warning is logged:
WARN [ContainerBackgroundProcessor[StandardEngine[Catalina]]] entry.ServerStringValue - Cannot normalize the value :Encountered name based id of memberOf which was not found in the OID registry
This causes problems later on because my application tries to user the memberOf attribute as a search filter.
Is anything wrong with the way I specified the LDIF entry?
For my integration test cases on top of embedded Apache Directory Server I've added both memberOf and sAMAccountName attributes defined in Microsoft Active Directory server.
#########################################################
# MICROSOFT SCHEMA for sAMAccountName and memberOf
# these two attributes are not defined in Apache Directory Server
#########################################################
dn: cn=microsoft, ou=schema
objectclass: metaSchema
objectclass: top
cn: microsoft
dn: ou=attributetypes, cn=microsoft, ou=schema
objectclass: organizationalUnit
objectclass: top
ou: attributetypes
dn: m-oid=1.2.840.113556.1.4.221, ou=attributetypes, cn=microsoft, ou=schema
objectclass: metaAttributeType
objectclass: metaTop
objectclass: top
m-oid: 1.2.840.113556.1.4.221
m-name: sAMAccountName
m-equality: caseIgnoreMatch
m-syntax: 1.3.6.1.4.1.1466.115.121.1.15
m-singleValue: TRUE
dn: m-oid=1.2.840.113556.1.4.222, ou=attributetypes, cn=microsoft, ou=schema
objectclass: metaAttributeType
objectclass: metaTop
objectclass: top
m-oid: 1.2.840.113556.1.4.222
m-name: memberOf
m-equality: caseIgnoreMatch
m-syntax: 1.3.6.1.4.1.1466.115.121.1.15
m-singleValue: FALSE
dn: ou=objectclasses, cn=microsoft, ou=schema
objectclass: organizationalUnit
objectclass: top
ou: objectClasses
dn: m-oid=1.2.840.113556.1.5.6, ou=objectclasses, cn=microsoft, ou=schema
objectclass: metaObjectClass
objectclass: metaTop
objectclass: top
m-oid: 1.2.840.113556.1.5.6
m-name: simulatedMicrosoftSecurityPrincipal
m-supObjectClass: top
m-typeObjectClass: AUXILIARY
m-must: sAMAccountName
m-may: memberOf
#######################################################
# Megacorp employees
#######################################################
dn: cn=EmployeeABC,ou=nl_users,DC=corp,DC=megacorp,DC=COM
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectclass: simulatedMicrosoftSecurityPrincipal
cn: EmployeeABC
sn: EmployeeABC
givenName: EmployeeABC
mail: EmployeeABC#megacorp.com
MEMBEROF: CN=just-users,OU=mc_groups,DC=corp,DC=megacorp,DC=com
MEMBEROF: CN=best-users,OU=mc_groups,DC=corp,DC=megacorp,DC=com
SAMACCOUNTNAME: employeeabc
The ApacheDS team is aware of the desire for the memberOf virtual attribute. They mention that it will be part of the 2.1.0 release:
Le 5/20/13 5:53 PM, Danielsen, Jay a écrit :
I see from the January 2013 archives that memberOf virtual attribute is not yet supported.
Are there any plans or work-in-progress to support memberOf in an upcoming release ? Morst certainly in 2.1.0.
We are currently busy cleaning the 150 remaining issues before a
2.0.0-RC1 release, so I think this is something we can have in the next 6 months.
You can create a JIRA to request such a feature.
Thanks !
-- Regards, Cordialement, Emmanuel Lécharny www.iktek.com
And here is the JIRA request.
You may need to add the schema that contains 'memberOf' into the ApacheDS configuration.
How do I delete one attribute in LDAP with LDIF? I an trying to delete uniqueMember: cn=jsmith,ou=users,dc=s2rsolutions,dc=com can someone please show me the LDIF to do it?
dn: cn=USER,ou=groups,dc=s2rsolutions,dc=com
objectClass: groupOfUniqueNames
cn: USER
uniqueMember: cn=jsmith,ou=users,dc=s2rsolutions,dc=com
uniqueMember: cn=guest,ou=users,dc=s2rsolutions,dc=com
uniqueMember: cn=admin,ou=users,dc=s2rsolutions,dc=com
uniqueMember: cn=ford,ou=users,dc=s2rsolutions,dc=com
dn: cn=USER,ou=groups,dc=s2rsolutions,dc=com
changetype: modify
delete: uniqueMember
uniqueMember: cn=jsmith,ou=users,dc=s2rsolutions,dc=com