I think this might be a simple question with a complicated explanation.
I was hoping someone could help me with how to setup my LDAP tree. I want to have groups and users. A user may belong to one group or several. The groups represent different services/applications the users should have access to, i.e access to login with VPN.
I am using OpenLDAP and I have the following tree structure (with the domain example.com).
-dc=example,dc=com --ou=groups ---cn=VPN (members=user1) ---cn=redmine (members=user1,user2) ---cn=vCenter (members=user2,user3) --ou=users ---cn=user1 ---cn=user2 ---cn=user3
All users are objectclasses inetOrgPerson, posixAccount and top (I used Generic: User Account in phpLdapAdmin to create them). I have the memberOf overlay up and running so queries like (memberOf=cn=VPN,ou=groups,dc=example,dc=com) works.
Now the problem. Some applications I use (for example redmine) has functionality where I can define the filter to use and thus use the memberOf overlay. Other applications/services do not have this but only a base dn in which it searches, i.e vCenter does the following query,
There is no way to change anything other than the base dn it searches in. How can i then use ldap to check if users should have access to i.e vCenter given that the user is a member of the vCenter group in the LDAP tree.
Running into this problem makes me think that i have misunderstood how LDAP works.