up vote 1 down vote favorite
2
share [g+] share [fb]

Is there any way to use one of LDAP's DN-based groups for linux groups instead of using the uid-based posixGroup objectclass?

More broadly, is there any way I can avoid having one set of groups for supporting linux accounts and a parallel set of groups that's used by everything else?

link|improve this question
100% accept rate
feedback

1 Answer

up vote 4 down vote accepted

Yes.

In your nss_ldap configuration file, set nss_schema:

nss_schema rfc2307bis

On your server in the schema, make sure the posixGroup object class is auxiliary instead of structural.

Then you can use both the groupofmembers(new) or groupofnames(old) and posixgroup objectclasses for each group. Each member will be in a member attribute:

dn: cn=foo,ou=Groups,dc=example
objectclass: top
objectclass: posixgroup
objectclass: groupofmembers
gidnumber: 9234
member: uid=bob,ou=people,dc=example
member: uid=alice,ou=people,dc=example
link|improve this answer
had to add groupOfMembers to my schema manually and add nss_map_attribute uniqueMember member but I got it working. Now I'm stuck on nested groups, know anything about that? – bemace Jan 27 '11 at 20:28
Nevermind, it started working. I think I probably had just some bogus values that were messing things up. – bemace Jan 28 '11 at 3:36
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.