Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am setting up an OpenLDAP server on Ubuntu so that this will be the authoritative user database for authentication. I'm going to be using Atlassian Crowd with it so that Google Apps can then use SSO against Crowd.

To further maximise the investment in LDAP, I want to use Google's directory sync tool so that IT can manage the LDAP details and then the sync tool will upload to Google. This will also ensure that if the user uses Crowd to change their password, GADS will resync the password to Google so that non-SSO applications like smartphones, POP, etc, continue to work.

My question stems from how best to define some of the objects in OpenLDAP. People seem to be fairly straightforward to define as the inetOrgPerson objectClass defines all of the attributes I want.

Mailing groups and contacts seem to be harder to pin down as I cannot find any objectClasses that fit the bill. For example, groupOfUniqueNames doesn't have a mail attribute (for defining the email address). I cannot find anything that would seem to resemble a contact.

The documentation for GADS suggests that the tool would look for an attribute like "literal" as holding the email address. There aren't any suggestions on what might be used for contacts.

Any suggestions on how I can proceed? I do want to use LDAP for the groups rather than Google Apps because I also want to use the group membership to control access to resources such as SSH access to servers, git repository access, etc.

Many thanks.

share|improve this question
add comment

2 Answers 2

up vote 1 down vote accepted

It turns out that Google's sync tool, GADS, is very flexible about things like objectClasses. In fact, it isn't necessary to worry about things at that level. GADS allows you to tell it what attribute refers to what piece of information, and you can also define the search filter to help it just get, say, the users or just the groups.

So I ended up using groupOfUniqueNames for the mailing list groups and I add the extensibleObject class to that to allow me to define the missing attributes like the email address.

share|improve this answer
    
Could you explain more on the details of implementing GroupofURI's as well as the extensible objectclass in OpenLdap? Implementing GADS sounds simple until you start looking at the attribute requirements. –  Pyperdown Jan 27 at 19:31
add comment

If it is openldap than you can use groupOfURIs, which allows empty list, to link beetween persons and groups (dynlist overlay allows you to suck some other attributes from it's destination. Hope it helps. man slapo-dynlist.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.