Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This is a follow-up to this question: I added the memberof overlay to an existing OpenLDAP 2.4 server. Now I want to update the existing user objects.

For new group memberships, the memberOf attribute is updated correctly. But I have a bunch of existing groups which aren't updated automatically. I could remove all users from their groups and re-add them to make sure these entries are in sync. Since this is a Univention Corporate Server which does a lot of magic when you modify the LDAP, I don't want to risk breaking my directory.

Is there a way to trick the overlay to update these operational attributes?

share|improve this question
up vote 0 down vote accepted

The only time when the memberOf overlay will be activated is if you modify a member in a group. So, the only way to "trick" it into updating the memberOf attributes would indeed be to remove all users from their groups and re-add them, as you suggested.

An alternative would be to use an external tool to synchronize groups and their members's entries.

You could write your own script for this - something along the lines of "for each group, read the members, for each member, run a LDAP "modify" operation to "add" a value to the memberOf attribute of that member's entry.

Or, probably more reliable, you could use a tool like LSC (LDAP Synchronization Connector) which has pretty much everything already done: you just need to configure the mapping you want. The trick with LSC is to use the same LDAP server as both source and destination, and running through all users to make sure that the memberOf attribute contains the list of groups that results from searching all groups for member=. The LSC website has a tutorial to do this, sort of, but it's a bit outdated.

share|improve this answer
Thanks for the pointer to LSC, I hadn't heard of that. What I did in the end was to use the official script shipped by Univention which follows the delete-and-readd approach. Originally I was afraid of doing this on my own since UCS has a bunch of hooks which get executed whenever the LDAP is changed. – mss Sep 19 '12 at 19:36

I think running slapindex will solve your problem. At least it sounds pretty much like what happens when you add a new index to your system.. You get funny results unless you run reindexing on old entries.

Please note that openldap server has to be stopped when you run this. And you should either run it as slapd user (like openldap) or run it as root and change permissions afterwords.

/etc/init.d/slapd stop
chown openldap:openldap /var/lib/ldap/*
/etc/init.d/slapd start


/etc/init.d/slapd stop
su - openldap -c  slapindex
/etc/init.d/slapd start

please read slapindex man pages before running this. And this should be safe unless you have corrupted database. (just remember to check the file permissions before start)

Commands how you stop and start your serices will depend on the Os flavour your running.

share|improve this answer
Interesting. I'll have a try once I'm around that system and report back. – mss Apr 10 '12 at 13:50
slapindex won't add these missing attributes. The reason is simple: slapindex rebuilds the indexes of the underlying BerkeleyDB database to enable search requests to be handled, and what is needed here is actual data to be added in to the OpenLDAP database (the memberOf attributes and their values). – Jonathan Clarke Sep 18 '12 at 16:41
True, but adding an index to a field that already has data will some times give funny results to all but new entries on searches. Reason being that the index has to manually created/recreated for existing data, but for new data the indexing works automatically. – Manwe Sep 29 '12 at 20:15

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.