Docker-openldap: How do you set up memberof?

[Ryonez]

For the almost the past two months my life has been on hold, while I try to sort out an authentication system for the services I host.

It's come down to the point I need LDAP. For the stuff that doesn't support oauth, or only support weirdly specific SSO's like plex(like comeon, why is plex an sso for organizer?), almost everything supports ldap as a backend. So with this in mind, I plan to use LDAP with keycloak linked to it, so I can get the most authentication methods I can, while having ldap to fall back on.

Now I've tried to use openLDAP before. However I had issues with memberof not working. I found this while trying to setup nextcloud. When trying to set it up, I get this message:

After trying to get it going, and finding out memberof is meant to be on by default for openLDAP, I gave up and looked elsewhere.

This lead me to FreeIPA. I was able to set it up, but it's super over the top for what I need, and Nextcloud has an issue with it, saying it's lost connection to the server, despite there been no issue when you test the connection in settings. This problem leaves users with ridiculous load times, 10min+ to log in, then for each page they try to navigate.

I figured at this point to try openLDAP again, to see if I can replicate the issue. However, I'm stuck with the memberof issue again. And it's slowly starting to kill me. I can't do anything else, everything revolves around having a working authentication system.

Does anyone have a guide from start to finish on how to set up groups and users that work with memberof?

The most straightforward guide was found here, but it's to old, things have changed. The only stage that fails is "Enabling MemberOf", but I though to finish the rest anyway because it's meant to be enabled anyway. However, I've had no luck.

Can anyone help please?

[bjozet]

You should setup a "groupOfUniqueNames", and add "uniqueMember" to the group. Then the overlay will render the "memberOf" attribute for your user.

I use it in my setup, and does not require any special configuration in the docker container.

[Ryonez]

So I'd be changing this?

Same stuff, make add_group.ldif

dn: cn=mygroup,ou=groups,dc=example,dc=com
objectClass: groupofnames
cn: mygroup
description: All users
member: uid=john,ou=people,dc=example,dc=com

To this?

dn: cn=mygroup,ou=groups,dc=example,dc=com
objectClass: groupofuniquenames
cn: mygroup
description: All users
uniquemember: uid=john,ou=people,dc=example,dc=com

[bjozet]

I think the uniquemember needs to be the dn, verify that you've set the uid as dn, otherwise change accordingly.
In my setup, the cn is used to construct the dn, so in my case I'd write

uniquemember: cn=bjozet,ou=people,dc=example,dc=com

[Ryonez]

dn: cn=mygroup,ou=groups,dc=example,dc=com
objectClass: groupofuniquenames
cn: mygroup
description: All users
uniquemember: uid=john,ou=people,dc=example,dc=com

This does seem to have worked, nextcloud is picking it up now.
Thank you @bjozet