I want to group users in project users in LDAP. Lets say there are user1, user2, user3, each with a password and ssh-key. I want to group them in project1, project2.

Given that user1 is member of group project1, he should be able to authenticate with username project1 and password/ssh-key from user1.

Is this possible with LDAP and if it is, can you please give some hints how to achieve this.

  • What other services are you trying to provide this group authorization for? It matters when you work with tools like Apache. – Jason Huntley Mar 26 '12 at 14:45
  • SSH, Jenkins, SVN (Apache) and some more. – stew Mar 26 '12 at 15:07

Not with standard LDAP methods, to my knowledge. It would be quite ineffective anyway, as LDAP would need to check the password against any member of the group1 to see if it is valid.

In theory, it could be done when you write your own authentication system (e.g. a new LDAP PAM plugin with this functionality), but it would open up a lot of problems, most prominent one the case of identical passwords between two users: As which one do you authenticate?

Any particular reason why you would want to do this?

  • They want to have only one user account per team/project but with different passwords and ssh-keys per real user for security reasons. – stew Mar 26 '12 at 11:12

Ok, so you can use a group strategy for each service. However, it's difficult to apply individual groups to projects within each service without customizations for each. For example, you can define separate groups for each service, SSH, Build Machine, SVN, etc.. For example, if you want users only in the source-control group to have access to SVN, you would specifiy the following URL in the cooresponding Apache virtual host:

<AuthnProviderAlias ldap ldap-users>
  AuthLDAPUrl "ldaps://myldapserver:636/DC=mydomain,DC=local?sAMAccountName?sub?(&(objectCategory=person)(memberOf=CN=source-control,CN=Users,DC=mydomain,DC=local))" "SSL"

However, you will have to drill down to the service level using their known management. Take SVN for example:

project1_team = dave, john, andy

* =
dave = rw

@project1_team = rw

andy = r

From: https://stackoverflow.com/questions/562755/how-do-i-prevent-a-subversion-user-accessing-part-of-the-repository


You want SASL Proxy Authorization (OpenLDAP docs). It's essentially su for OpenLDAP.
It will not, however, work with ssh-keys, as SASL doesn't understand them.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.