On Thu, 2009-05-21 at 15:28 +0200, Michael Ströder wrote:
John A. Sullivan III wrote:
> On Thu, 2009-05-21 at 18:07 +0600, Dmitry Amirov wrote:
>> Hello.
>>
>> My question is simple. I need to create unix group. If i try to do this
>> via New->Group, then i can't see posixGroup. So i can add posixGroup
>> only manually by adding needed attributes. But i want to add via console
>> such as i can add new user.
> <snip>
> If I correctly understand what you want, what I typically do is create
> the group, click on Advanced and add the posixgroup attribute. I then
> simply add users who have previously had the posixAccount attribute
> added to their definition.
I think instead of "add attribute" you meant to say "add auxiliary
object class".
But please note that the object classes groupOfNames/groupOfUniqueNames
and posixGroup are all defined as STRUCTURAL. Strictly speaking in the
spirit of LDAPv3 compliance an entry can only have exactly one
STRUCTURAL object class (including the inherited STRUCTURAL object
classes). Although the 389 DS does not prevent you from creating an
entry like this
objectClass: groupOfUniqueNames
objectClass: posixGroup
you shouldn't do that since it might lead to interop problems.
> I also find in RedHat style systems that I
> need to add the posixgroup attribute to the users.
???
'posixGroup' is an auxiliary object class containing the members'
'uid'
value in its multi-valued attribute 'memberUid'. Despite the issues with
STRUCTURAL I don't see any reason to add this object class to a person
or account entry anyway.
Ciao, Michael.
<snip>
Thanks very much for the clarification as I am (obviously) LDAP
ignorant. Yes, I did mean add an objectclass. Unfortunately, I think
we're a bit stuck because of RedHat's (useful) use of user groups.
Since most of the user directory files are owned by a group with the
same name as the user, I have major issues if I do not do this. I
suppose the correct solution would be to create a group of the same name
but then we hit potential problems with non-unique cn if we match uid
and cn and preserve uniqueness. What do others do? Thanks - John
--
John A. Sullivan III
Open Source Development Corporation
+1 207-985-7880
jsullivan(a)opensourcedevel.com
http://www.spiritualoutreach.com
Making Christianity intelligible to secular society