I am trying to figure out how to structure my ldap and/or configure sssd to read membership of nested groups.
Something like this works for normal group membership:
DN: cn=server-admins,ou=Groups,dc=example,dc=com groupOfNames (structural) posixGroup (auxiliary) memberUid userName1 memberUid userName2
and the sssd.conf doing something like:
[sssd] config_file_version = 2 domains = default services = nss, pam full_name_format = %1$s [domain/default] debug_level = 2 id_provider = ldap auth_provider = ldap cache_credentials = True ldap_uri = ldaps://ldapserver:636 ldap_search_base = dc=example,dc=com # start searching here ldap_user_search_base = ou=People,dc=example,dc=com # search these people ldap_group_search_base = ou=Groups,dc=example,dc=com ldap_group_nesting_level = 10 simple_allow_groups = server-admins
id userName1 I get the
server-admins membership and can log in with that user.
However, what I'd like to do is something like this:
DN: cn=server-admins,ou=Groups,dc=example,dc=com groupOfNames (structural) posixGroup (auxiliary) member cn=jobTitleGroup1,ou=Roles,dc=example,dc=com
Then have membership of the
jobTitleGroup1 contain the people:
DN: cn=jobTitleGroup1,ou=Roles,dc=example,dc=com groupOfNames (structural) posixGroup (auxiliary) memberUid userName1 memberUid userName2
The problem is sssd only seems to recognise the memberUid attribute, and doesn't seem to see/search the nested group membership of
So I don't know how to do nested groups, and/or don't know how to get sssd to read the membership of nested groups. Any help would be appreciated.