1

I think this might be a simple question with a complicated explanation.

I was hoping someone could help me with how to setup my LDAP tree. I want to have groups and users. A user may belong to one group or several. The groups represent different services/applications the users should have access to, i.e access to login with VPN.

I am using OpenLDAP and I have the following tree structure (with the domain example.com).

-dc=example,dc=com
--ou=groups
---cn=VPN (members=user1)
---cn=redmine (members=user1,user2)
---cn=vCenter (members=user2,user3)
--ou=users
---cn=user1 
---cn=user2
---cn=user3

All users are objectclasses inetOrgPerson, posixAccount and top (I used Generic: User Account in phpLdapAdmin to create them). I have the memberOf overlay up and running so queries like (memberOf=cn=VPN,ou=groups,dc=example,dc=com) works.

Now the problem. Some applications I use (for example redmine) has functionality where I can define the filter to use and thus use the memberOf overlay. Other applications/services do not have this but only a base dn in which it searches, i.e vCenter does the following query,

base="dc=xyzz,dc=se" filter="(&(objectClass=inetOrgPerson)(objectClass=inetOrgPerson)(uid=user1))

There is no way to change anything other than the base dn it searches in. How can i then use ldap to check if users should have access to i.e vCenter given that the user is a member of the vCenter group in the LDAP tree.

Running into this problem makes me think that i have misunderstood how LDAP works.

  • It's not you who have misunderstood, but the implementors of the LDAP "support" in various programs. There's almost never support for writing a proper ldap query/filter like LDAP was architected for. – ptman Sep 22 '13 at 17:09
  • How does one go about using LDAP in a bigger environment then? One requirement is that users needs to be authenticated based on what group they belong to. Should i create the same user in each group (this is bad if i need to update the user info (i.e psw) but might be a workaround?) – Chris Sep 23 '13 at 6:00
  • OpenLDAP can be heavily extended. Take a look at the translucent proxy overlay or rewrite/remap overlay or any other methods for presenting virtual views. – ptman Sep 23 '13 at 10:27
  • Thanks, i will look into it! If i come up with a good solution i will post back here. – Chris Sep 23 '13 at 20:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.