1

I'm using ApacheDS as directory server which is used in applications like Gogs (Git server like GitLab). My idea is to create groups like gogs-users and restrict the login to those group, so that only users who are member of that group are able to login. I have created a groupOfNames for this and a testuser, which is added to the gogs group.

The type of gogs-users is groupOfNames and it has an attribute member which contains the DN of my user (uid=testuser,ou=Users,DC=example,DC=com). So I'm able to see, who is a member of this group.

But I would like to see all groups where a user is a member of. When I open the testuser, I see no attribute that could tell me, that he's a member of gogs-users. I remember that the proprietary Active Directory had an attribute called memberOf whch was queryable in a filter like (&(objectClass=inetOrgPerson)(memberOf=CN=gogs-user,DC=example,DC=com)). That would be exactly what I need.

How can I get this in a free LDAP implementation? I see no way except defining a custom attribute - Which I had to maintenant per hand. That's not good, I would like to have an automated solution, that keep care of those attribute.

Things I already tried

Note: I did a complete reset after each scheme import, to make sure, that my tests are not influenced by previous changes.

Community
  • 1
  • 1
Lion
  • 16,606
  • 23
  • 86
  • 148
  • (member=uid=testuser,ou=Users,DC=example,DC=com) and a base of: DC=example,DC=com may work. – jwilleke May 02 '17 at 08:21
  • @jwilleke This gave me the group, not the members. `member` is a attribute of `groupOfNames`. That's the problem I have: There is only a reference from the group to their member user, but not not in the other way from the user to his groups. In AD the `memberOf` attribute fixes this issue. – Lion May 04 '17 at 15:25

1 Answers1

1

Here are Queries that will go either way but ONLY work for Microsoft Active Directory:

Resolves all members (including nested) Security Groups (requires at least Windows 2003 SP2):

(memberOf:1.2.840.113556.1.4.1941:=CN=gogs-user,DC=example,DC=com)

And All Groups a User is a member of including Nested Groups

(member:1.2.840.113556.1.4.1941:=CN=UserName,CN=Users,DC=YOURDOMAIN,DC=NET))
jwilleke
  • 10,467
  • 1
  • 30
  • 51
  • I'm not on AD and I don't want to be, as I said in the first sentence. I worked in the past with AD and I know this, but I need a similar solution for LDAP on ApacheDS. – Lion May 06 '17 at 11:18