2

I am currently working on integrating LDAP authentication into a system and I would like to restrict access based on LDAP group. The only way to do this is via a search filter and therefore I believe my only option to be the use of the memberOf attribute in my search filter. It is my understanding that the memberOf attribute is an operational attribute which can be created by the server for me anytime a new member attribute is created for any groupOfNames entry on the server. My main goal is to be able to add a member attribute to an existing groupOfNames entry and have a matching memberOf attribute be added to the DN I provide

I am working on OpenLDAP version 2.3.9. I know that version 2.4.31 is the latest, but it has a BerkeleyDB version dependency which i cannot update, hence I have to stick to version 2.3.9.

I have setup OpenLDAP the way it was described in the OpenLDAP guide and i am able to start the server. Now I am trying to add memberOf overlay to the config database. I added the following to slapd.conf:

database config
rootdn "cn=config"
rootpw secret

and i created a ldif file for memberOf:

dn: cn=module,cn=config
cn: module
objectclass: olcModuleList
objectclass: top
olcmoduleload: memberof.la
olcmodulepath: "path"

dn: olcOverlay={0}memberof,olcDatabase={1}hdb,cn=config
objectClass: olcConfig
objectClass: olcMemberOf
objectClass: olcOverlayConfig
objectClass: top
olcOverlay: memberof

and I am trying to add this overlay using command:

ldapadd -x -h "host" -p "port -D "cn=config" -f memberOf.ldif -w secret

I am getting the following error:

ldapadd: Internal (implementation specific) error (80)
    additional info: <olcModuleLoad> handler exited with 1

I have the following questions:

  1. Can we add overlays in versions less than 2.3?
  2. I read that we need to use -y EXTERNAL in ldapadd command

    I get the following error doing so:

    ldapadd: incompatible with authentication choice
    

Can someone tell what i am doing wrong? There are a lot of scattered resources which i tried but all end me up with the oclModuleLoad error.

3

It is my understanding that the memberOf attribute is an operational attribute which can be created by the server for me anytime a new member attribute is created for any groupOfNames entry on the server.

If you configure it that way. You haven't finished the configuration. You need to specify what attributes and objectClasses the overlay is going to maintain the memberOf attribute for. You're going to need something like this, adapted for your own needs:

olcMemberOfDangling ignore
olcMemberOfGroupOC  groupOfNames
olcMemberOfMemberAD member
olcMemberOfMemberOfAD   memberOf
olcMemberOfRefInt   TRUE

in addition to what you already have.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.