User Object Filter for group membership - FedoraDS / 389 DS

[sandro gehrig]

Hy there

I'm struggling to the user object filter fo our 389 directory server. I set it up using the fedoraDS type and so far all works (except the strange behaviour of syncs not working every ~3d time).

But until now I wasn't able to filter the user object to match a specifig group. I know for MS Active Directory it works like this

$((objectclass=posixAccount)(memberOf=group))

But since the "memberOf" attribute is the MS way of ldap implement/interpretation I have to find another way.

Can JIRA go the other way, searching a group for memberUid attribute values instead of searching the user for the memberOf attribute?

btw: I konw about the plugins available for memberOf on 389ds but our frontend also doesn't understand it.

Thanks for any help suggestions

sandro

[sandro gehrig · Accepted solution]

Thanks for the answer.

As mentioned, I know about this plugin, but our frontend (LAM / phpldapadmin) does not understand it out of the box / does not call this plugin when adding a user to a group.

[sandro gehrig]

So, confluence cannot search group members based on the group and then compare with users?

Do I really have to have all users inside my ldap search (and so inside wiki search, even though they do not consume license) only because we don't got the memberOf attribute?

[Bruna Griebeler]

Hi Sandro,

Usually we just use "ldap.group.filter": "(objectclass=posixGroup)" as filter for FedoraDS.

But since you need to filter, I suggest you to use the the memberOf plugin for FedoraDS.

Hope it helps!

Kind Regards