On ti, 27 marras 2018, Peter Tselios via FreeIPA-users wrote:

Hello, I have an non-IPA aware application to succssfuly login users from IPA's LDAP. However, I cannot make it work with group membership. It seems that the LDAP filter is not working and using LDAP search proves that the app is not wrong.

So, what I have: myself (ptselios) member of the group grafana-adms.

The group is stored as: ldapsearch -x -W -D "uid=nonipaapps,cn=sysaccounts,cn=etc,dc=example,dc=com" -b "cn=groups,cn=accounts,dc=example,dc=com" "(&(objectClass=groupOfNames)(cn=grafana-adms))" -h localhost -p 389 -s sub

dn: cn=grafana-adms,cn=groups,cn=accounts,dc=example,dc=com member: uid=ptselios,cn=users,cn=accounts,dc=example,dc=com member: uid=anotheruser,cn=users,cn=accounts,dc=example,dc=com ipaNTSecurityIdentifier: S-1-5-21-120251393-583861438-3385547448-1050 objectClass: top objectClass: groupofnames objectClass: nestedgroup objectClass: ipausergroup objectClass: ipaobject objectClass: posixgroup objectClass: ipantgroupattrs cn: grafana-adms description:: blabla ipaUniqueID: ccc54368-ce1d-11e8-b523-06db1b82a33a gidNumber: 690200050

Now, when I search with the memberuid I get an empty response: ldapsearch -x -W -D "uid=nonipaapps,cn=sysaccounts,cn=etc,dc=example,dc=com" -b "cn=groups,cn=accounts,dc=example,dc=com" "(&(objectClass=groupOfNames)(memberuid=ptselios))" -h localhost -p 389 -s sub

# search result search: 2 result: 0 Success

# numResponses: 1

Obviously, the filter is wrong, but what is the correct one?

memberUid is an attribute from RFC2307. Primary tree in FreeIPA is supporting RFC2307bis schema where there is no memberuid attribute but rather member attribute is in use. The difference is that 'member' attribute is a full DN of a member object while memberuid is just a user name.

memberuid attribute is provided in the compat subtree.

Are you able to modify your application to use RFC2307bis schema?