5

I'm trying to set up OpenLDAP on a Debian 7.7 server.

While basic auth seems to work, I can't get the "memberof" overlay to work.

Being new to LDAP, all that memberof config seems overly complex to me - despite having read numerous tutorials...

In my current config I mostly followed the tutorial at http://gos.si/blog/installing-openldap-on-debian-squeeze-with-olc

I say mostly, because I skipped the step in the "Creating a LDAP Database" section. The reason is, that I can't create my database since the desired olcRootDN (cn=admin,dc=indunet,dc=it) is already taken. It's already there right after installing slapd using aptitude. Maybe it's a left-over from a previous installation, but I did aptitude purge slapd and even removed the /var/lib/ldap/ directory and made sure there were no more .ldif files around, so I have no clue why cn=admin,dc=indunet,dc=it comes from.

So, I tried to configure the pre-existing database olcDatabase={1}hdb,cn=config this way (I've added the highlighted entry): enter image description here

For reference, the parent group (the "database") has these attributes: enter image description here (fullsize here)

I can see this config only when logging in with the bind DN cn=admin,cn=config. I can't add users/groups there (probably because that's just for configuration, right?). So I added a few groups and a user using the DN cn=admin,dc=indunet,dc=it in phpLDAPadmin.

In Apache DS that config looks like this:

enter image description here

I'm not sure if memberOf should be visible in this screen (I guess so), but anyway that attribute is defenitely not being sent to the client that depends on it.

It wouldn't surprise me if my config is completely broken, but I spent 2 days trying to fix this and honestly have run out of ideas...

Update

As time passed and I've played around with LDAP, this is my new current tree: enter image description here

Udo G
  • 443
  • 4
  • 9
  • 20

1 Answers1

2

I guess, you dont quite understand how a memberof works.

http://www.openldap.org/doc/admin24/guide.html#Reverse%20Group%20Membership%20Maintenance

you should create cn=Udo as inetOrgPerson in 'cn=users,dc=indunet,dc=it', then you should create cn=plainuser as groupOfMembers or groupOfUniqueMembers in 'cn=groups,dc=indunet,dc=it', then you should add 'Member' or 'UniqueMember' attribute to cn=plainuser,cn=groups,dc=indunet,dc=it.

After that you will get 'MemberOf' attribute in 'cn=Udo,cn=users,dc=indunet,dc=it'.

also, remind, this attribute is hidden normally. to see this attribute, you must enable the displaying of operational attributes.

Nik
  • 439
  • 3
  • 4
  • Yes, I'm a complete novice to LDAP and so may confuse some things. You say I should create cn=Udo in `cn=users,dc=indunet,dc=it`. I already have it in `ou=users,dc=indunet,dc=it` ("ou", not "cn"). What's the difference? Please note my update in the meantime. I have no `cn=groups,dc=indunet,dc=it` anymore. Is my tree completely wrong now? Thanks for your patience. – Udo G Nov 10 '14 at 08:56
  • This answer is spot on. Getting by this information without being told is almost impossible. – sjas Sep 17 '17 at 23:38