[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: Search Filter ...

Jonathan Clarke a écrit :

On 03/10/2009 01:21, Remi Ferrand wrote:

Hi,

I've the following configuration in my OpenLDAP :

1.
dn: cn=stats.mysite.fr,ou=Group,dc=mysite,dc=fr
2.
cn: stats.mysite.fr
3.
objectClass: top
4.
objectClass: groupOfNames
5.
description: VirtualHost stats.mysite.fr
6.
member: uid=user_authorized,ou=People,dc=mysite,dc=fr
7. member: uid=USER,ou=People,dc=mysite,dc=fr
8.
9.
10.
dn: uid=USER,ou=People,dc=mysite,dc=fr
11.
objectClass: top
12.
objectClass: person
13.
objectClass: inetOrgPerson
14.
objectClass: organizationalPerson
15.
objectClass: posixAccount
16.
objectClass: shadowAccount
17.
uid: USER
18.
cn: USER P.
19.
sn: USER P.
20.
shadowMax: 99999
21.
shadowWarning: 7
22.
mail: USER@google.eu
23.
loginShell: /bin/bash
24.
uidNumber: 10007
25.
gidNumber: 10007
26.
homeDirectory: /home/ldap_users/USER
27.
gecos: ,,,



and I'm wondering how to create a filter to match only members of a
given Group in order to use it with Apache2 or others ...

The difficulty for me is to obtain the posixAccount object and not the
Group one.
You can't return account objects from a search based on groups, whatever the filter. Not with one LDAP search, anyway.
Most LDAP clients can check whether an entry is a member of a group. Apache's LDAP auth[nz] module does it too, see: 
http://httpd.apache.org/docs/2.2/mod/mod_authnz_ldap.html#reqgroup

Regards,
Jonathan

Thanks Jonathan,

Too bad Dovecot is not able to check membership of a username ...
My Apache2 configuration is already based on what you sent me and works very well ;)
I guess that my last possibility for this to work with Dovecot is to add a "member" field in every "objectClass= posixAccount" and to use a search filter as : 
(&(objectClass=posixAccount)(member=MY_GROUP_DN))

Thanks again
Rémi