Re: two issues with dyngroups

[Pierangelo Masarati <ando@sys-net.it>]

Guillaume Rousse wrote:
> Hello list.
>
> I'm an happy users of dynlist overlay, in order to make my unix users 
> members of their unix primary group:
>
> # admins, groups, msr-inria.inria.fr
> dn: cn=admins,ou=groups,dc=msr-inria,dc=inria,dc=fr
> objectClass: groupOfURLs
> objectClass: posixGroup
> gidNumber: 5000
> memberURL: 
> ldap:///ou=users,dc=msr-inria,dc=inria,dc=fr??sub?(gidNumber=5000)
> cn: admins
>
> With this configuration:
> # dynamic groups
> overlay dynlist
> dynlist-attrset groupOfURLs memberURL member
>
> However, I'm facing two issues here.
>
> The first is that dynlist overlay only accept a single configuration 
> directive for the whole base, preventing to map differently the request 
> URL depending on the context. In my previous example, I need to map the 
> URL as DN, because I'm dynamically building a group from users. If I 
> wanted to build a group from other group, my  URL would have been 
> something as:
> ldap:///ou=group,dc=msr-inria,dc=inria,dc=fr?member?sub?(cn=users)
>
> and the configuration directive would have been instead
> dynlist-attrset groupOfURLs memberURL
>
> It would be nice to handle the overlay differently there.
>
> The second directive is that ACLs seems to ignore this dynamic group:
> # admins
> access to dn.subtree="dc=msr-inria,dc=inria,dc=fr"
>     by group="cn=admins,ou=groups,dc=msr-inria,dc=inria,dc=fr" write
>     by * break

Try

access to dn.subtree="dc=msr-inria,dc=inria,dc=fr"
     by group/groupOfURLs/memberURL="cn=admins,ou=groups,dc=msr-inria,dc=inria,dc=fr" write
     by * break

(please excuse any unintended line wrapping).

> This worked with a static group, it doesn't work anymore with a dynamic 
> one as I just presented.
>
> I'm using OpenLDAP 2.4.11. Should I open ITS for those issues ?

Issue #2 should be fixed by the above rule.  I suggest you file a
request for enhancement for issue #1, consisting in adding an (optional)
URI to each dynlist-attrset that allows to restrict the application of
the attrset to selected dynamic group entries matching the base, scope
and filter of the URI (if present).

The configuration would become something like

dynlist-attrset <group-oc> <URL-ad>
        [ ldap:///base??scope?filter ]
        [[<mapped-ad>:]<member-ad> ...]

and, in your case, you would need something like

overlay dynlist
dynlist-attrset groupOfURLs memberURL
        ldap:///cn=admins,ou=groups,dc=msr-inria,dc=inria,dc=fr??base
        member
dynlist-attrset groupOfURLs memberURL
        ldap:///cn=users,ou=groups,dc=msr-inria,dc=inria,dc=fr??base

p.



Ing. Pierangelo Masarati
OpenLDAP Core Team

SysNet s.r.l.
via Dossi, 8 - 27100 Pavia - ITALIA
http://www.sys-net.it
-----------------------------------
Office:  +39 02 23998309
Mobile:  +39 333 4963172
Fax:     +39 0382 476497
Email:   ando@sys-net.it
-----------------------------------