I'm exploring the idea of authenticating users on some RHEL 6.4 boxes using LDAP. I'm using sssd with an LDAP provider, and setting the nsswitch.conf file to use sss for passwd/shadow/group.

How can I set things up so that system users (which don't come from LDAP) can be in the same groups as LDAP users? For example, I might want some LDAP users to be in a "svn" group, so they have access to a SVN repository. But I also need the SVN server to run as a user in that group, and that user doesn't come from LDAP. Is this possible?

  • How do you expose the subversion server? using apache?
    – dawud
    May 17, 2014 at 19:02
  • Yeah, but that's just a made-up example...there are other cases where I want to put system users in the same group as LDAP users.
    – JW.
    May 17, 2014 at 19:30

1 Answer 1


I don't know SSSD, but if your LDAP database is properly rfc2307bis-02 compliant, then you should be able to add both member and memberUid attribute values to any group in the LDAP database. The member values are used for dn based LDAP users, memberUid values are for local users, who of course do not have dns. For example, the following should add a local user called fred and an LDAP user called ethel to vipb group:

$ ldapmodify -D <admin DN> -h <ldaphost> -W
password: [enter password]
dn: cn=vipb,ou=groups,dc=example,dc=com
changetype: modify
add: memberUid
memberUid: fred
add: member
member: uid=ethel,ou=users,dc=example,dc=com


Caching will get in the way, so:

$ nscd --invalidate=group

You can then check the group membership:

$ id -nG fred
$ id -nG ethel

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .