Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Our school's website has the ability to pull user authentication from a LDAP source. They "support" and LDAP. Unfortunately, to pull group membership you must have a memberOf attribute in each users' record. OS X Lion Server does not store users group membership in their record by default.

I've read about OpenLDAP's memberOf overlay, and I am hoping that will work. But I don't know how to set it up, I've read the comment on How do I configure Reverse Group Membership Maintenance on an openldap server? (memberOf) but I'm not comfortable importing the LDIF until I know better what it does and if I have to import an ldif for each user. Also, I believe Open Directory uses posixGroups not a groupOfNames.

Questions: Is it possible to enable the memberOf attribute in Apple's OS X Open Directory implementation of OpenLDAP? If I enable it will it dynamically update the memberOf attribute when I add users to groups with Workgroup Manager? How do I enable the memberOf attribute?

share|improve this question
Did you find any solution ? I'm searching for the same thing for a while ... – Yvan GODARD Dec 19 '13 at 21:44

If you already search a solution to do this, I have written a post on my blog with a workaround solution and script :

share|improve this answer
We really do prefer that answers contain content not pointers to content. Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. – Iain Jan 3 '14 at 17:46

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.