Docker-openldap: Does memberof over get automatically installed?

[JohnOmernik]

I was reviewing other issues and they talk about the support for the member of ldif being applied at first run, however, I am unclear if it IS automatically applied, or still has to be manually setup. Is there a setting to apply or not apply it?

Thanks

[Dexyon]

The memberOf value is filled by default, you only need to use the correct groups and attributes. Can you clearify why your are asking this?

[RayBor]

If I may add, I never managed to make it work.
How can we "use correct group and attributes" exactly ?
When creating a child entry with phpldapadmin, the option memberOf isn't available.
Thanks for your help

[Dexyon]

The memberOf property is not something that you need to fill yourself.
The memberOf is a overlay which gets triggered when a modification is done on a group for example.

In this docker the overlay for the memberOf is already present, however it is only triggers when modifications are done in a groupOfUniqueNames.

If you wish to trigger the overlay on a different group (let's say groupOfNames), then you need to create your own docker (based upon this docker) and override the memberOf overlay ldif file.

See also:
https://github.com/osixia/docker-openldap/blob/stable/image/service/slapd/assets/config/bootstrap/ldif/03-memberOf.ldif

[dolanor]

I created 2 groups: groupOfNames, groupOfUniqueNames and added existing users to it. It didn't create the memberOf attribute in those users.

...

# people, multiverse
dn: ou=people,dc=multiverse
ou: people
objectClass: organizationalUnit
objectClass: top

# dolanor, people, multiverse
dn: cn=dolanor,ou=people,dc=multiverse
givenName: Dolanor
sn: Tharivae
cn: dolanor
uid: dolanor
uidNumber: 1000
homeDirectory: /home/dolanor
loginShell: /bin/sh
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: top
gidNumber: 501
mail: [email protected]


# anarmindon, people, multiverse
dn: cn=anarmindon,ou=people,dc=multiverse
givenName: Anarmindon
sn: Tharivae
cn: anarmindon
uid: anarmindon
uidNumber: 1001
gidNumber: 501
homeDirectory: /home/anarmindon
loginShell: /bin/sh
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: top


# testgroup, apps, txg.re.multiverse
dn: cn=testgroup,ou=apps,dc=txg,dc=re,dc=multiverse
cn: testgroup
objectClass: groupOfNames
objectClass: top
member: cn=dolanor,ou=people,dc=multiverse
member: cn=anarmindon,ou=people,dc=multiverse

# testuniquegroup, apps, txg.re.multiverse
dn: cn=testuniquegroup,ou=apps,dc=txg,dc=re,dc=multiverse
cn: testuniquegroup
objectClass: groupOfUniqueNames
objectClass: top
owner: cn=dolanor,ou=people,dc=multiverse
uniqueMember: cn=dolanor,ou=people,dc=multiverse
uniqueMember: cn=anarmindon,ou=people,dc=multiverse
uniqueMember: cn=testmember,ou=people,dc=multiverse

# testmember, people, multiverse
dn: cn=testmember,ou=people,dc=multiverse
cn: testmember
objectClass: inetOrgPerson
objectClass: top
pager: cn=admin,dc=multiverse
userPassword:: e01ENX1Vc2Z0clRiL0ovbXc5ZmVUTC80SytBPT0=
sn: testmember

...

[dolanor]

My bad. I did an ldapsearch without any filter.

ldapsearch -x -LLL -W -D cn=admin,dc=multiverse -H ldap:/// -b dc=multiverse

But doing

ldapsearch -x -LLL -W -D cn=admin,dc=multiverse -H ldap:/// -b dc=multiverse memberof

returned the correct results.
So I'm happy.

But if anyone has an explanation why the first command didn't output memberof attribute, I'm all ears. (I thought without filter would display EVERYTHING)

[Dexyon]

@dolanor Did you read up on how the ldapsearch is working?
http://www.openldap.org/software//man.cgi?query=ldapsearch&apropos=0&sektion=1&manpath=OpenLDAP+2.4-Release&format=html

This is taken from the Description part:

 If  ldapsearch  finds  one or more entries, the attributes specified by
       attrs are returned.  If * is listed, all user attributes are  returned.
       If  +  is listed, all operational attributes are returned.  If no attrs
       are listed, all user attributes are returned.  If only 1.1  is  listed,
       no attributes will be returned.

Is you do not specify anything you just get the user attributes, such as the properties you see in your result. The memberOf property is a operation attr, therefor this should be requested explicitly

[dolanor]

No, I didn't read that part. LDAP is completely new to me, and there is so much to absorb already, I didn't have time to go through every information. I mostly learned through trial and error and checking tutorials/blog articles.
Thank you for pointing me to that documentation!

[Dexyon]

No thanks! Happy I could help. @osixia , this issue can be closed I guess.

[BertrandGouny]

@Dexyon thanks :)