17

Our corporate LDAP directory is housed on a Snow Leopard Server Open Directory setup. I'm trying to use the ldapsearch tool to export an .ldif file to import into another external LDAP server to authenticate with externally; basically trying to be able to use the same credentials internally and externally.

I've got ldapsearch working and giving me the contents and attributes of everything in the "Users" OU, and even filtering down to only the attributes I need:

ldapsearch -xLLL -H ldap://server.domain.net / 
 -b "cn=users,dc=server,dc=domain,dc=net" objectClass / 
 uid uidNumber cn userPassword > directorycontents.ldif

That gives me a list of users and properties that I can import to my remote OpenLDAP server.

dn: uid=username1,cn=users,dc=server,dc=domain,dc=net
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: organizationalPerson
uidNumber: 1000
uid: username1
userPassword:: (hashedpassword)
cn: username1

However, when I try the same query on an OD "group" instead of a "container," the results are something like this:

dn: cn=groupname,cn=groups,dc=server,dc=domain,dc=net
objectClass: posixGroup
objectClass: apple-group
objectClass: extensibleObject
objectClass: top
gidNumber: 1032
cn: groupname
memberUid: username1
memberUid: username2
memberUid: username3

What I really want is a list of users from the top example filtered based on their group memberships, but it looks like membership is set from the Group side, rather than the user account side. There must be a way to filter this down and only export what I need, right?

Improve this question

3 Answers 3

Reset to default
5

I work with LDAP, but not that specific brand of server.

First thing I'd try is a search on users pulling all of their attributes instead of restricting it the way your example does.

ldapsearch -xLLL -H ldap://server.domain.net \
    -b "cn=users,dc=server,dc=domain,dc=net" uid=username1 \* +

Often there's a "memberOf" attribute on the user that lists the group name or group DN for groups that a user is in, kept in sync with the information in the group. If that's there, that is the easiest way to do what you want.

The * will grab all user attributes (the default behavior) and the + will grab all operational attributes (special attributes).

Improve this answer
3
  • This is an old thread but it should be mentioned that in OpenLDAP (the basis of Open Directory) memberOf is an operational attribute and needs to be requested explicitly. A mere ldapsearch like suggested here won't return memberOf, even if it exists. It should also be mentioned that the memberOf overlay is not usually enabled by default, although I don't know how this is handled in OS X and Open Directory.
    – daff
    Nov 13, 2011 at 2:31
  • @daff I believe a + should get all the operational attributes...
    – freiheit
    Nov 13, 2011 at 2:39
  • Ah, indeed. Your updated ldapsearch works as advertised.
    – daff
    Nov 13, 2011 at 5:30
3 
ldapsearch -x \
-b "cn=<your group name>,ou=group,dc=<your org>,dc=com" \
-H ldaps://<ldap server>:<port>

This works very well.

Improve this answer
0

Are you aiming to represent groups by having user objects located in different containers? Like:

dn: uid=username1,cn=users,cn=accounting,dc=server,dc=domain,dc=net
...
dn: uid=username2,cn=users,cn=engineering,dc=server,dc=domain,dc=net
...

If so, I expect you're going to have to write a script to massage the LDIF. Try the excellent Python-LDAP modules.

I would question why you want to do that though. It makes it messy to have users that belong to multiple groups, and is contrary to Open Directory's conventions. Can't you just copy all the user and group objects to your OpenLDAP server, and query it based on group membership rather than which container the user object exists in?

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .