That is what I have found to date in DS but Mac OSX services does allow this through a
mechanism I have yet to explore.
It seems like a ripe target for a DS plugin so the PAM modules in each server could remain
stock yet take advantage of nested groups. I was hoping that someone already had a schema
and a plugin to do this.
-----Original Message-----
From: Rich Megginson [mailto:rmeggins@redhat.com]
Sent: Monday, December 10, 2012 2:45 PM
To: General discussion list for the 389 Directory server project.
Cc: Deas, Jim
Subject: Re: [389-users] Nested groups ldap to PAM
On 12/10/2012 03:24 PM, Deas, Jim wrote:
Fedora-DS is what I am currently using.
So if you have a group like this:
cn=group1,...
member: uid=foo,...
cn=group2,...
member: uid=bar,...
member: cn=group1,...
And your client queries group2, you want your client to see
member: uid=foo,...
member: uid=bar,...
without having to read member: cn=group1 and explicitly expand it?
389/Fedora DS can't do this.
-----Original Message-----
From: Rich Megginson [mailto:rmeggins@redhat.com]
Sent: Monday, December 10, 2012 1:56 PM
To: General discussion list for the 389 Directory server project.
Cc: Deas, Jim
Subject: Re: [389-users] Nested groups ldap to PAM
On 12/10/2012 02:29 PM, Deas, Jim wrote:
I am about to upgrade our systems to the current version. One of my difficulty's in
the old version was the lack of nested groups.
Is there a way with the current software to create nested groups in openldap
Not sure what you mean by "in openldap". Are you using 389 or openldap server?
that will be seen properly by the linux PAM module and Mac OSX?
Regards,
JD
--
389 users mailing list
389-users@lists.fedoraproject.org<mailto:389-users@lists.fedoraproject.org>
https://admin.fedoraproject.org/mailman/listinfo/389-users
--
389 users mailing list
389-users@lists.fedoraproject.org<mailto:389-users@lists.fedoraproject.org>
https://admin.fedoraproject.org/mailman/listinfo/389-users