OpenLDAP ACL to prevent anonymous user from getting list of all groups

Question

I am trying to secure existing OpenLDAP installation where it is a requirement to allow anonymous user to retrieve information about records if it knows uid of specific user entry in LDAP. Assume structure as below:

dc=example,dc=com
  ou=People
    uid=user1
    uid=user2
  ou=Groups
    cn=user1
      memberUid:user1
    cn=user2
      memberUid:user2
    cn=common
      memberUid:user1
      memberUid:user2

Now if anonymous know that entry uid=user1 exist in LDAP, they should be able to retrieve list of groups where this user is a member. However they should not be able to discover other groups.

Thus ldapsearch -b "ou=Groups,dc=example,dc=com" should return nothing, while ldapsearch -b "ou=Groups,dc=example,dc=com" "(&(objectClass=posixGroup)(memberUid=user1))" should return all groups where user1 is member.

I've tried a few different ACLs to no luck so far. It is either search is working but also can list all groups, or cannot list all groups but then search is not working.

Is there a way to achieve desired behavior using ACLs?

PS: The database uses standard nis schema, since the database already have data changing to rfc2307bis is not an option (and there are other reasons why such change is not possible in this case).

Answer 1

I don't think this is possible this way around, as you couldn't restrict which groups can be read. However, OpenLDAP offers an alternative way that might help you. This is called "Reverse Group Maintenance" (see Chapter 12.8 in the (outdated) docs) with the memberOf overlay. Basically, it maintains a list of every group a user is member of, which allows for easy lookups of this type of information.

For help how to do this the modern way, with cn=config, look here.