[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: memberOf

Pierangelo Masarati wrote:
"memberOf" is not part of any standard track schema definition, so it is
unlikely that OpenLDAP's slapd can handle it.  Moreover, as you're not
popupating the directory with values for the memberOf attribute, it is
very unlikely that you can find occurrences of it in the data.  The
directory acts according to the garbage-in garbage-out principle, only it
doesn't accept all types of garbage, it requires garbage to comply with

If you expect OpenLDAP slapd to implement some automatic update of
back-links to group membership you're on the wrong trail.  Applications
(in this case, those clients that feed the directory) are supposed to
maintain them.

There has been in the past some activity to implement that in an overlay,
so that it is the DSA itself, or rather an embedded client, that maintains
that type of consistency; that project hung on the lack of some design
issues and on the lack of atomicity in multiple write operations that
characterized slapd at that time.  I guess LDAP transactions under
development for HEAD should solve those isues.  You may try to implement
your own, or I could try and revitalize that project in my spare time
(which might be never based on my current availability of spare time...).


Thank you for the reply.

I see what you're saying... I found some past discussions on this topic:

I'm just trying to support one standard mechanism, but it appears that there is none...
Active Directory does support 'dynamic' memberOf attribute which made me assume that it's some kind of a standard (I said that I'm very new to LDAP).

It looks like I'll have to implement two JAAS Login Modules for LDAP: one with and the other without dynamic memberOf support.