On Tue, 2016-02-16 at 12:54 +0100, Frank Munsche wrote:
Hi guys,
how can I determine the members of a dynamic group? After some research, it is
still not obvious to me. There is an example at page 220 of the redhat
directory server adm guide at:
https://access.redhat.com/documentation/en-US/Red_Hat_Directory_Server/10...
dministration_Guide/Red_Hat_Directory_Server-10-Administration_Guide-en-US.pdf
Within the 389 console you can list the members of the dynamic group using the
'test' button. Unfortunately, I'm using a stripped down installation of 389
without the admin server. But it should be possible to list the members of a
dynamic group using ldapsearch, or?
I've tried to query the dyn group object itself, but the members are missing:
ldapsearch -H
ldap://ldap.example.org -D "cn=directory manager" -W -Z -x -b
'cn=admin,ou=sampleapp,ou=appgroups,dc=example,dc=org' 'objectclass=*'
dn: cn=admin,ou=sampleapp,ou=appgroups,dc=example,dc=org
objectClass: top
objectClass: groupOfUniqueNames
objectClass: groupOfURLs
cn: admin
description: sampleapp admin users dyn group
memberURL: ldap:///ou=people,dc=example,dc=org??sub?(&(objectclass=pers
on)(mail=*example.org))
You can test this by running an ldap search as:
ldapsearch -b ou=people,dc=example,dc=org -s sub
'(&(objectclass=person)(mail=*example.org))'
OpenLDAP has an "overlay" which allows the memberUrl to be expanded during a
search request into "member" attrs on the groupOfUrls.
Right now, we don't have this in 389-ds.
If you have an account on fedorahosted, we would really appreciate you lodging a
ticket about this.
Otherwise, you need to do the expansion by hand.
Sorry about that,
--
Sincerely,
William Brown
Software Engineer
Red Hat, Brisbane