Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've needed to configure LDAP authentication for Joomla! and the only way to get it to work together (with LDAP group based was by using groupOfUniqueNames, not the posixGroup. In other words, Joomla expects LDAP to follow the RFC2307bis schema.

This beg the question: do other LDAP using applications understand the RFC2307bis schema?

From what I could find, the 4 most important applications do:

  • pam_ldap and nss_ldap
  • Samba
  • Gosa
  • phpLDAPAdmin

Besides that, what is the state of general support for this schema (Apache auth, squid, groupware suites, freeradius)?

Any problems with such configuration (rfc2307bis, pam_ldap, nss_ldap and samba)?

share|improve this question
And there are several revisions of the RFC2307bis schema — draft 02 was changed to use groupOfMembers class with the optional member attribute for groups, while the older draft 01 used groupOfUniqueNames, where the uniqueMember attribute is mandatory (therefore creating an empty group is not possible without hacks; draft 02 finally fixes this problem). – Sergey Vlasov Dec 14 '10 at 15:21
up vote 0 down vote accepted

From what GOsa² developers said, they are using modified RFC2307 schema that not only uses groupOfUniqueNames as @SergeyVlasov noted is standard in second draft, but also duplicate the regular NIS schema giving full backwards compatibility (as long as one doesn't use other administrative tools for changing group membership or user creation).

I haven't tried it yet, but it looks like one can use this modified schema without problems.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.