Share all details related to your problem, including any error messages you may have received.
Hey Folks, I’m attempting to pull in LDAP groups and memberships via the OpenLDAP connector and also have those memberships appear as isMemberOf attributes on the link. After aggregation/refresh, I’m able to see that the groups I’m filtering for are successfully added to the Entitlements Catalog, but it’s missing the memberships, and I’m at a loss as to why.
With respect to Group Schema, is the memebers in the group displayed in isMemberOf attribute. Usually, the memberOf attribute is used for displaying groups on the user and member attribute is used to display members in a group.
I have this working in my PoC IIQ environment with OpenLDAP:
In my account schema I have:
<AttributeDefinition entitlement="true" managed="true" multi="true" name="groups" schemaObjectType="group" type="string">
<Description>List of groups a user is a member</Description>
</AttributeDefinition>
<AttributeDefinition entitlement="true" managed="true" multi="true" name="posixgroups" schemaObjectType="posixgroup" type="string">
<Description>List of posix groups a user is a member</Description>
</AttributeDefinition>
<AttributeDefinition entitlement="true" managed="true" multi="true" name="nisNetgroups" schemaObjectType="nisNetgroup" type="string">
<Description>List of nisnet groups a user is a member</Description>
</AttributeDefinition>
The group schema (for posixgroup, to only group-type I have used to demo):
<Schema aggregationType="group" descriptionAttribute="" displayAttribute="cn" featuresString="PROVISIONING" identityAttribute="dn" instanceAttribute="" nativeObjectType="posixgroup" objectType="posixgroup">
<AttributeDefinition name="cn" type="string">
<Description>common name(s) for which the entity is known by</Description>
</AttributeDefinition>
<AttributeDefinition multi="true" name="memberUid" type="string">
<Description>unique member of a posixGroup</Description>
</AttributeDefinition>
<AttributeDefinition name="dn" type="string">
<Description>Directory Path</Description>
</AttributeDefinition>
<AttributeDefinition name="gidNumber" type="string">
<Description>Group ID</Description>
</AttributeDefinition>
<AttributeDefinition name="description" type="string">
<Description>descriptive information</Description>
</AttributeDefinition>
<Attributes>
<Map>
<entry key="groupMemberAttribute" value="memberUid"/>
<entry key="memberAttribute">
<value>
<List>
<String>cn</String>
<String>uid</String>
</List>
</value>
</entry>
</Map>
</Attributes>
</Schema>
I wanted to clarify my situation further by sharing the LDIF for the group I’m targeting:
version: 1
dn: cn=TEST Group,ou=Groups,o=orgname.org,o=orgname
objectClass: groupofmembers
objectClass: top
cn: TEST Group
description: Test Group for Testing
member: uid=testuser1,ou=People,o=orgname.org,o=orgname
member: uid=testuser2,ou=People,o=orgname.org,o=orgname
member: uid=testuser3,ou=people,o=orgname.org,o=orgname
And this is the LDIF for a user who is a member of that group:
version: 1
dn: uid=testuser1,ou=People,o=orgname.org,o=orgname
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: top
cn: First Last
sn: Last
givenName: First
isMemberOf: cn=test group,ou=groups,o=orgname.org,o=orgname
isMemberOf: cn=another group,ou=groups,o=orgname.org,o=orgname
mail: [email protected]
telephoneNumber: +1 123 555 5555
uid: testuser1
@Jarin_James :
I tested with memberOf, but the result is the same.
Re. search dn: I’m looking to add the group “TEST Group”, and the members therein.
Re. isMemberOf, YES, the group is displayed in the isMemberOf on the user, e.g. testuser1.
Thanks for the reply. I think posix group is different. Looking at the docs, posixgroup looks for memberUid. The docs don’t really specify what to do in case of regular groups and isMemberOf.
Do you think it’s worth trying anyway as a posixgroup? I’m happy to give it a shot.
Thanks, but this also did not work. It created the entitlement in the entitlements catalog, but no memberships added, and the attribute field is blank. Checked the identity, and nothing showed up under entitlements.
Appreciate everyone’s help so far. This is a tricky one for sure.
I believe the main issue here is that it is not currently working with “groupOfMembers”, which is different from the “groupOfUniqueNames”, “posixGroupsd”, “group” and “nisNetGroup”.
Does anyone else have experience using “groupOfMembers”?
