Docker-openldap: MemberOf doesn't work.

[BROUSSOLLE-Brice]

Hi everyone,
I've started to configure LDAP server with MemberOf Attributes but is not working.
I initialize my LDAP server with this LDIF file :

# Entry 6: ou=people,dc=exemple,dc=org
dn: ou=people,dc=exemple,dc=org
objectclass: organizationalUnit
objectclass: top
ou: people

# Entry 7: cn=Brice Broussolle,ou=people,dc=exemple,dc=org
dn: cn=Brice Broussolle,ou=people,dc=exemple,dc=org
cn: Brice Broussolle
displayname: Brice Broussolle
givenname: Brice
mail: [email protected]
objectclass: inetOrgPerson
objectclass: top
objectclass: person
sn: Broussolle
uid: bbroussolle
userpassword: {MD5}R3+Ui19AtM/5OGv6haBhkA==

# Entry 8: cn=Christophe Robert,ou=people,dc=exemple,dc=org
dn: cn=Christophe Robert,ou=people,dc=exemple,dc=org
cn: Christophe Robert
displayname: Christophe Robert
givenname: Christophe
mail: [email protected]
objectclass: inetOrgPerson
objectclass: top
objectclass: person
sn: Robert
uid: cRobert
userpassword: {MD5}R3+Ui19AtM/5OGv6haBhkA==

# Entry 3: ou=groups,dc=exemple,dc=org
dn: ou=groups,dc=exemple,dc=org
objectclass: organizationalUnit
objectclass: top
ou: groups

# Entry 4: cn=Application Admins,ou=groups,dc=exemple,dc=org
dn: cn=Application Admins,ou=groups,dc=exemple,dc=org
cn: Application Admins
objectclass: groupOfNames
objectclass: top
member: cn=Brice Broussolle,ou=people,dc=exemple,dc=org

# Entry 5: cn=Application Users,ou=groups,dc=exemple,dc=org
dn: cn=Application Users,ou=groups,dc=exemple,dc=org
cn: Application Users
objectclass: groupOfNames
objectclass: top
member: cn=Brice Broussolle,ou=people,dc=exemple,dc=org
member: cn=Christophe Campan,ou=people,dc=exemple,dc=org

After that, when I search for users, the "MemberOf" attribute never appeared.

Anyone could me to explain where i've made a mistake or what is happening.

Thank you all.

[baykovr]

Could you verify that you are on the latest version? As of 1.1.2 memberof should be loaded.

[vgeyer]

Hey there,

i have exactly the same problem.

ldapadd -v -h localhost -c -x -D cn=admin,dc=my-company,dc=com -f test.ldiff -W

test.ldiff:

dn: ou=users, dc=my-company,dc=com
changetype: add
ou: users
objectclass: organizationalunit

dn: ou=groups, dc=my-company,dc=com
changetype: add
ou: groups
objectclass: organizationalunit

dn: cn=test1,ou=users,dc=my-company,dc=com
changetype: add
cn: test1
sn: Test1
mail: [email protected]
objectClass: inetOrgPerson
objectclass: top
userPassword: test1

dn: cn=test2,ou=users,dc=my-company,dc=com
changetype: add
cn: test2
sn: Test2
mail: [email protected]
objectClass: inetOrgPerson
objectclass: top
userPassword: test2


dn: cn=admins, ou=groups, dc=my-company,dc=com
changetype: add
cn: admins
objectclass: groupOfNames
objectclass: top
member: cn=test1,ou=users,dc=my-company,dc=com

dn: cn=users, ou=groups, dc=my-company,dc=com
changetype: add
cn: users
objectclass: groupOfNames
objectclass: top
member: cn=test2,ou=users,dc=my-company,dc=com

ldapsearch -x -h localhost -b "dc=my-company,dc=com" -D "cn=admin,dc=my-company,dc=com" -W

Output:

# extended LDIF
#
# LDAPv3
# base <dc=my-company,dc=com> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#

# my-company.com
dn: dc=my-company,dc=com
objectClass: top
objectClass: dcObject
objectClass: organization
o: My Company
dc: my-company

# admin, my-company.com
dn: cn=admin,dc=my-company,dc=com
objectClass: simpleSecurityObject
objectClass: organizationalRole
cn: admin
description: LDAP administrator
userPassword:: e1NTSEF9ZVNsSXRKR2U3NDB4VFBCbklONzlMc2VSUFVJbmpjM00=

# users, my-company.com
dn: ou=users,dc=my-company,dc=com
ou: users
objectClass: organizationalUnit

# groups, my-company.com
dn: ou=groups,dc=my-company,dc=com
ou: groups
objectClass: organizationalUnit

# test1, users, my-company.com
dn: cn=test1,ou=users,dc=my-company,dc=com
cn: test1
sn: Test1
mail: [email protected]
objectClass: inetOrgPerson
objectClass: top
userPassword:: dGVzdDE=

# test2, users, my-company.com
dn: cn=test2,ou=users,dc=my-company,dc=com
cn: test2
sn: Test2
mail: [email protected]
objectClass: inetOrgPerson
objectClass: top
userPassword:: dGVzdDI=

# admins, groups, my-company.com
dn: cn=admins,ou=groups,dc=my-company,dc=com
cn: admins
objectClass: groupOfNames
objectClass: top
member: cn=test1,ou=users,dc=my-company,dc=com

# users, groups, my-company.com
dn: cn=users,ou=groups,dc=my-company,dc=com
cn: users
objectClass: groupOfNames
objectClass: top
member: cn=test2,ou=users,dc=my-company,dc=com

# search result
search: 2
result: 0 Success

It does look like as the modules are not enabled/loaded.

https://technicalnotes.wordpress.com/2014/04/19/openldap-setup-with-memberof-overlay/

Victor

Update: I tried it with "osixia/openldap:latest" and "osixia/openldap:1.1.2", both seem to be affected.

[mikefaille]

To use memberof, you must add rfc2307bis schema:
https://github.com/ClubCedille/docker-openldap/commit/15bd02c759288ac0eece7f6e653483c988b727a1

cc : @osixia As you could see :

• I installed schema from rfc2307bis
• I sed /usr/share/slapd/slapd.init.ldif to replace nis by rfc2307bis (to bypass dpkg-reconfigure)
• and finally, I replace image/service/slapd/assets/schema-to-ldif.sh from this docker script.

But, do we have better way to manage this ? I don't think just because dpkg-reconfigure who fetch by default on /usr/share/slapd/slapd.init.ldif....

[Toonix]

Hope this is soon fixed...I need this memberOf

@mikefaille
dosn't work for me...same problem.

[mikefaille]

My bad @Toonix @bricebroussolle and @vgeyer,
you all actually need to replace groupOfNames by groupOfUniqueNames as specified in current setup :
https://github.com/osixia/docker-openldap/blob/stable/image/service/slapd/assets/config/bootstrap/ldif/03-memberOf.ldif

[jntnl42]

@mikefaille I wish I read your comment earlier. :+1:

If you really need groupOfNames, the quick fix to edit 03-memberOf.ldif

• olcMemberOfGroupOC: groupOfUniqueNames --> "groupOfNames"
• olcMemberOfMemberAD: uniqueMember --> "member"

and use the makefile to build your own version of the Docker Image. This worked great for me.

[fir4]

Also note that as per memberOf overlay documentation, memberOf is an operational attribute and won't be displayed on a regular search, you need to request it explicitly. The same observation was made in #75

[Niondir]

I would love to see this fixed in the Image. Or can someone explain when the this values are actually better than the defaults?