Re: posixgroups vs groupofnames

[Howard Chu <hyc@symas.com>]

Doug OLeary wrote:
> Hey;
>
> Here's the end goal: Have the ability to have posixgroup style support for
> gid <-> group_name translation and the ability to use memberof style searches
> without data duplication.
>
> In short:
>
> # ldapsearch -xLLL -s sub '(uid=doleary)' memberof
> dn: uid=doleary,ou=users,dc=oci,dc=com
> memberOf: cn=infra,ou=groups,dc=oci,dc=com
> memberOf: cn=ldap-Administrators,ou=groups,dc=oci,dc=com
> memberOf: cn=infosec,ou=groups,dc=oci,dc=com
> memberOf: cn=dba,ou=groups,dc=oci,dc=com
>
> and
>
> # groups doleary
> doleary : ldap-users ldap-Administrators infosec infra
>
> Using a standard rfc2307 install, the only way I was able to get there was by
> having duplicate groups, one posix and one groupofnames.
>
> I've been playing around with rfc2307bis the last few days.  While I'm able to
> have one group, in order to support the desired functionality, I still have to
> have two member types in that group - member and memberuid:

An LDAP NSS module properly configured to use rfc2307bis doesn't need or use 
memberuid.

OpenLDAP nssov just uses rfc2307bis by default.

--
  -- Howard Chu
  CTO, Symas Corp.           http://www.symas.com
  Director, Highland Sun     http://highlandsun.com/hyc/
  Chief Architect, OpenLDAP  http://www.openldap.org/project/