|
Hey guys,
I got a huge problem here. I’ve been trying to merge users from a local LDAP (ou=local-users,ou=accounts,dc=domain: which authenticates against a remote active directory (which is not ldap://remote.site) with sasl) with
local users who use a local stored password and with users from a remote active directory without storing them locally.
Let’s say i have the following structure:
Local-LDAP (ldap://localhost):
Remote-AD (ldap://remote.site):
The local LDAP structure works as expected. When i request ou=accounts,dc=domain
i get all users located in ou=local-users and ou=users.
And now i point out the problem:
I only get the object ou=remote-users without the users from
ou=accounts,dc=remote-domain so the ou=remote-users seems to be empty. But when i explicit request the full DN of
ou=remote-users (ou=remote-user,ou=accounts,dc=domain) i get the full list of all users located in
ou=accounts,dc=remote-domain.
Here’s my slapd.conf:
#######################################################################
# Global Directives:
#######################################################################
# Schema and objectClass definitions
include /etc/ldap/schema/core.schema
include /etc/ldap/schema/cosine.schema
include /etc/ldap/schema/inetorgperson.schema
# Where the pid file is put. The init.d script
# will not stop the server if you change this.
pidfile /var/run/slapd/slapd.pid
# List of arguments that were passed to the server
argsfile /var/run/slapd/slapd.args
# Read slapd.conf(5) for possible values
logfile /etc/ldap/slapd.log
loglevel 1
sasl-host localhost
sasl-secprops none
#######################################################################
# Dynamic Module Directives
#######################################################################
# Base Path and individual modules.
modulepath /usr/lib/ldap
moduleload back_hdb.so
moduleload refint.so
moduleload memberof.so
moduleload back_meta.so
moduleload rwm.so
# Defining referral integrity module to make sure the group relations are automatically updated. NOTE: Only when a 'delete' or 'edit' command has been issued.
overlay refint
refint_attributes member uniqueMember seeAlso
refint_nothing cn=EMPTY
# Defining memberof module which make sure to update the group affiliation for each user. NOTE: Added an own attribute to all users named: 'memberOf' which contains all groups.
overlay memberof
#######################################################################
# Database Directives:
#######################################################################
database meta
suffix "ou=remote-users,ou=accounts,dc=domain"
readonly off
lastmod off
uri "ldap://remote.site/ou=remote-users,ou=accounts,dc=domain"
suffixmassage "ou=remote-users,ou=accounts,dc=domain“ „ou=accounts,dc=remote-domain"
idassert-bind bindmethod=simple
binddn=„cn=root,dc=remote-domain"
credentials=„root"
mode=none
flags=non-prescriptive
idassert-authzFrom „dn.exact:cn=root,dc=remote-domain"
database hdb
directory /var/lib/ldap
suffix „dc=domain"
rootdn "cn=root,dc=domain"
rootpw root
index objectclass eq
index uid eq,sub
lastmod off
readonly off
My Search Results at parent OU:
#### ldapsearch -M -a always -D "cn=root,dc=domain" -w root -b "ou=accounts,dc=domain“ dn
# extended LDIF
#
# LDAPv3
# base <ou=accounts,dc=domain> with scope subtree
# filter: (objectclass=*)
# requesting: dn
# with manageDSAit control
#
# accounts, domain
dn: ou=accounts,dc=domain
# local-users, accounts, domain
dn: ou=local-users,ou=accounts,dc=domain
# frank, local-users, accounts, domain
dn: cn=frank,ou=local-users,ou=accounts,dc=domain
# remote-users, accounts, domain
dn: ou=remote-users,ou=accounts,dc=domain
# users, accounts, domain
dn: ou=users,ou=accounts,dc=domain
# peter, users, accounts, domain
dn: cn=peter,ou=users,ou=accounts,dc=domain
My Search Results at child and proxied OU:
#### ldapsearch -M -a always -D "cn=root,dc=domain" -w root -b „ou=remote-accounts,ou=accounts,dc=domain“ dn
# extended LDIF
#
# LDAPv3
# base <ou=remote-users,ou=accounts,dc=domain> with scope subtree
# filter: (objectclass=*)
# requesting: dn
# with manageDSAit control
#
# remote-users, accounts, domain
dn: ou=remote-users,ou=accounts,dc=domain
dn: cn=albert,ou=remote-users,ou=accounts,dc=domain
I hope you guys can help me out.
If you have further question, please leave a mail.
Kind regards,
Marvyn :)
|