ldapopenldapmemberof

memberof and refint does not work in openLdap

I'm using CentOs 7.x 64 bit version to set up openLdap. I want to use the memberof overlay to show on a user what groups they are members of. My understanding was that with memberof and refint overlays active the Openldap server automatically maintains the memberof property on users and ensures it is consistent with actual memberships. However, it is not doing this at all. I can set the memberof property manually but it does not have to be consistent and it is not being maintained automatically.

Question is: Am I right in my understanding of how it should work and how do I get it working?

My main requirement is it shows the memberships accurately. if I could manipulate the memberships via memberof that would be good, but it's not essential.

Details

I did it in the following steps:

  1. Create a person in the people group, with objectClass 'inetOrgPerson' and 'person'. And named 'Joe'
  2. Create a group that is 'groupOfNames', named 'agent'. And with member attribute with value 'uid=joe,ou=people,dc=company,dc=com'

Now when I looked into person 'Joe', I couldn't find the 'memberOf' attribute with 'showing organisational attribute' enabled in Apache ldap studio. And with the following command line searching, also can't find the group.

ldapsearch -H ldap://localhost -x -b "dc=company,dc=com" '(uid=joe)' memberOf

The following is a snippet of slapcat:

dn: ou=people,dc=company,dc=com
objectClass: organizationalUnit
ou: people
description: Application users
structuralObjectClass: organizationalUnit
entryUUID: 82532aa8-f3e8-1039-9c72-6f4976491fc1
creatorsName: cn=root,dc=company,dc=com
createTimestamp: 20200306112229Z
entryCSN: 20200306112229.195806Z#000000#000#000000
modifiersName: cn=root,dc=company,dc=com
modifyTimestamp: 20200306112229Z

dn: uid=joe,ou=people,dc=company,dc=com
uid: joe
cn: joe.doe
sn: doe
objectClass: inetOrgPerson
objectClass: person
userPassword:
structuralObjectClass: inetOrgPerson
entryUUID: 079b9550-03b2-103a-89f5-811bd9f87026
creatorsName: cn=root,dc=company,dc=com
createTimestamp: 20200326133249Z
entryCSN: 20200326133249.091679Z#000000#000#000000
modifiersName: cn=root,dc=company,dc=com
modifyTimestamp: 20200326133249Z

dn: cn=a1,ou=agent,dc=company,dc=com
member: uid=joe,ou=people,dc=company,dc=com
cn: a1
objectClass: groupOfNames
structuralObjectClass: groupOfNames
entryUUID: 2c9df272-047e-103a-9203-eba7d52bfa3f
creatorsName: cn=root,dc=company,dc=com
createTimestamp: 20200327135408Z
entryCSN: 20200402133540.270695Z#000000#000#000000
modifiersName: cn=root,dc=company,dc=com
modifyTimestamp: 20200402133540Z

I'm using ansible to run the configuration. Here is a snippet of config file

- name: Install memberof and refint overlays
  include_tasks: "{{ role_path }}/tasks/add_module_to_ldap_conf.yml"
  vars:
    add_module_to_ldap: "{{ item }}"
  loop:
    - name: memberof overlay
      module_file: 'memberof.la'
    - name: refint overlay
      module_file: 'refint.la'

- name: Activate overlays
  include_tasks: "{{ role_path }}/tasks/put_ldap_admin_entry.yml"
  vars:
    put_ldap_entry:
      dn: "olcOverlay={{ item.overlay }},'olcDatabase={2}hdb','cn=config'"
      objectClass: "{{ item.objectClass }}"
      attributes: "{{ item.attributes }}"
  loop:
    - overlay: memberof
      objectClass:
        - top
        - olcConfig
        - olcMemberOf
        - olcOverlayConfig
      attributes:
        olcOverlay: memberof
        olcMemberOfRefint: 'TRUE'
        olcMemberOfDangling: ignore
        olcMemberOfGroupOC: groupOfNames
        olcMemberOfMemberAD: member
        olcMemberOfMemberOfAD: memberOf
    - overlay: refint
      objectClass:
        - top
        - olcConfig
        - olcRefintConfig
        - olcOverlayConfig
      attributes:
        olcOverlay: refint
        olcRefintAttribute: 'memberof member manager owner'

I tried to add memberOf attribute manually and the search can return the group. However, it does not maintain the group when the person's group is updated. So I suspect that the refint is not working either.

ldapsearch -H ldap://localhost -x -b "dc=company,dc=com" '(uid=joe)' memberOf

Here is the active overlays snippet:

ldapsearch -LL -Y EXTERNAL -H ldapi:/// -b cn=Overlays,cn=Monitor -s base monitoredObject
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
version: 1

dn: cn=Overlays,cn=Monitor
objectClass: monitorContainer
cn: Overlays
description: This subsystem contains information about available overlays.
monitoredInfo: refint
monitoredInfo: memberof
monitoredInfo: glue
Solution

  • The initial config we had was missing the following attributes:

    olcMemberOfDangling: ignore
olcMemberOfGroupOC: groupOfNames
olcMemberOfMemberAD: member
olcMemberOfMemberOfAD: memberOf

    I did ldapmodify manully for the following config

    dn: olcOverlay=memberof,olcDatabase={2}hdb,cn=config
objectClass: olcMemberOf
objectClass: olcOverlayConfig
objectClass: olcConfig
objectClass: top
olcOverlay: memberof
olcMemberOfDangling: ignore
olcMemberOfRefInt: TRUE
olcMemberOfGroupOC: groupOfNames
olcMemberOfMemberAD: member
olcMemberOfMemberOfAD: memberOf

    Then the membership worked. After we removed the missed attribute and rerun the Ansible it seems that it doesn't unfix it. So we are not sure about what was wrong.