How do I update the memberOf attributes of existing objects after adding the OpenLDAP Reverse Group Membership Maintenance overlay?

Question

This is a follow-up to this question: I added the memberof overlay to an existing OpenLDAP 2.4 server. Now I want to update the existing user objects.

For new group memberships, the memberOf attribute is updated correctly. But I have a bunch of existing groups which aren't updated automatically. I could remove all users from their groups and re-add them to make sure these entries are in sync. Since this is a Univention Corporate Server which does a lot of magic when you modify the LDAP, I don't want to risk breaking my directory.

Is there a way to trick the overlay to update these operational attributes?

Answer 1

I think running slapindex will solve your problem. At least it sounds pretty much like what happens when you add a new index to your system.. You get funny results unless you run reindexing on old entries.

Please note that openldap server has to be stopped when you run this. And you should either run it as slapd user (like openldap) or run it as root and change permissions afterwords.

/etc/init.d/slapd stop
slapindex
chown openldap:openldap /var/lib/ldap/*
/etc/init.d/slapd start

or

/etc/init.d/slapd stop
su - openldap -c  slapindex
/etc/init.d/slapd start

please read slapindex man pages before running this. And this should be safe unless you have corrupted database. (just remember to check the file permissions before start)

Commands how you stop and start your serices will depend on the Os flavour your running.