search

georchestra / LDAP

Several optional LDAP-related utilities and scripts for geOrchestra
3 stars 6 forks source link

Use groupOfMembers instead of groupOfNames #5

Closed landryb closed 9 years ago

landryb commented 9 years ago

groupOfNames doesn't allow to use empty groups, which leads to hacks like fakeuser... groupOfMembers allows this, so let's import this objectClass and use it instead. For more informations on it, see http://www.openldap.org/lists/openldap-technical/201312/msg00038.html and the rfc it references.

I didnt want to replace the whole nis schema by rfc2307bis as per http://bubblesorted.raab.link/content/replace-nis-rfc2307-rfc2307bis-schema-openldap because it seems a bit like a huge hammer.

Tweak memberOf overlay config to trigger on the correct objectClass while here. This PR only takes care of the LDAP example tree & scripts.

I've tested this locally, importing the ldif schema with

ldapadd -Y EXTERNAL -H ldapi:/// -f /tmp/georchestra-groupofmembers.ldif

and then (using shelldap) creating an empty group, and a group with a member containing a fullDN.

fvanderbiest commented 9 years ago

LGTM. If no one objects (ping @pmauduit @fgravin @jesseeichar @mcanevet ), will merge tomorrow.

pmauduit commented 9 years ago

LGTM also (even if it would probably make my VM autogeneration fail :()