OpenLDAP Child or Relay server configuration assistance

RuMAN S

2/27/24, 5:53 AM

I am a really lost here and would appreciate some help.

My organization already maintains an OpenLDAP server which allows read-only access

Running this gives me an entire dump of all the users and groups and OUs in my organization.

ldapsearch -x -b dc=corp,dc=ORG,dc=com -H ldap://xx.eng.yy.ORG.com

This is good, now I have the organization hierarchy in my hand.

Next, I want to create an OpenLDAP server and have this server "override" groups that are not present in the parent OpenLDAP server, so for example in the Parent/Main LDAP server:

There is an OU=support in which there's 100s of users. I want to add more granularity to these users.

What I would like to do on my CHILD LDAP server is:

Create a new group named Support-NewHires
Add a small number of users from OU=support in this new group.

So when I use CHILD ldap server anywhere and login as one of the users in Support-NewHires, the LDAP query will be forwarded to the PARENT LDAP server (for passwords) but the permissions would be set according to where I configured Support-NewHires to access.

Lets say John is a new hire in OU=Support and Jane is a veteran in OU=Support. So, I add John to OU=Support-NewHires

Now I have an application with LDAP integration (VMware vCenter), I would integrate with CHILD LDAP server. I will set restricted Access Controls for OU=Support-NewHires group and Full Control access to OU=Support group

Now when John logs in, he will see the restricted view, but if Jane logs in she will get the unrestricted view. I wont have to deal with storing any of their passwords or other details, just their UID=

Note that I do not have write permissions to access PARENT LDAP server.

0 + 0

openldap

ldap

ldapsearch

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: OpenLDAP Child or Relay server configuration assistance

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.