Score:1

SSSD, openLDAP and nested groups

jm flag

I am trying to figure out how to structure my ldap and/or configure sssd to read membership of nested groups.

Something like this works for normal group membership:

DN: cn=server-admins,ou=Groups,dc=example,dc=com
groupOfNames (structural)
posixGroup (auxiliary)
memberUid userName1
memberUid userName2

and the sssd.conf doing something like:

[sssd]
config_file_version = 2
domains = default
services = nss, pam
full_name_format = %1$s

[domain/default]
debug_level = 2
id_provider = ldap
auth_provider = ldap
cache_credentials = True
ldap_uri = ldaps://ldapserver:636
ldap_search_base = dc=example,dc=com
# start searching here
ldap_user_search_base = ou=People,dc=example,dc=com
# search these people
ldap_group_search_base = ou=Groups,dc=example,dc=com
ldap_group_nesting_level = 10
simple_allow_groups = server-admins

if I id userName1 I get the server-admins membership and can log in with that user.

However, what I'd like to do is something like this:

DN: cn=server-admins,ou=Groups,dc=example,dc=com
groupOfNames (structural)
posixGroup (auxiliary)
member cn=jobTitleGroup1,ou=Roles,dc=example,dc=com

Then have membership of the jobTitleGroup1 contain the people:

DN: cn=jobTitleGroup1,ou=Roles,dc=example,dc=com
groupOfNames (structural)
posixGroup (auxiliary)
memberUid userName1
memberUid userName2

The problem is sssd only seems to recognise the memberUid attribute, and doesn't seem to see/search the nested group membership of jobTitleGroup1.

So I don't know how to do nested groups, and/or don't know how to get sssd to read the membership of nested groups. Any help would be appreciated.

I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.