OpenLDAP: recuperar membros de um grupo

Question

Eu habilitei o memberof module no openldap. Adicionado dois grupos e alguns membros sob eles. (groupOfNames)

Quando imprimi os membros de um determinado grupo usando o filtro (&(objectClass=groupOfNames)(cn=bowlers)) , ele imprime apenas o primeiro membro do grupo, embora tenha vários membros.

Como listar todos os membros de um grupo?

# extended LDIF
#
# LDAPv3
# base <dc=example,dc=com> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#

# example.com
dn: dc=example,dc=com
objectClass: top
objectClass: dcObject
objectClass: organization
o: Sierraware
dc: example

# admin, example.com
dn: cn=admin,dc=example,dc=com
objectClass: simpleSecurityObject
objectClass: organizationalRole
cn: admin
description: LDAP administrator
userPassword:: e1NTSEF9NFZXYit2MlVBS2xRVUdBOWVjK2IrSHBac3VpYnV6ZlM=

# People, example.com
dn: ou=People,dc=example,dc=com
objectClass: organizationalUnit
objectClass: top
ou: People

# Groups, example.com
dn: ou=Groups,dc=example,dc=com
objectClass: organizationalUnit
objectClass: top
ou: Groups

# adam, People, example.com
dn: uid=adam,ou=People,dc=example,dc=com
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
uid: adam
sn: hanks
givenName: adam
cn: Adam hanks
displayName: Adam hanks
uidNumber: 10000
gidNumber: 5000
userPassword:: YWRhbWxkYXA=
gecos: Adam hanks
loginShell: /bin/bash
homeDirectory: /home/adam

# john, People, example.com
dn: uid=john,ou=People,dc=example,dc=com
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
uid: john
sn: doe
givenName:: am9obiA=
cn: John Doe
displayName: John Doe
uidNumber: 10000
gidNumber: 5000
userPassword:: am9obmxkYXA=
gecos: John Doe
loginShell: /bin/bash
homeDirectory: /home/john


# wahab, People, example.com
dn: uid=wahab,ou=People,dc=example,dc=com
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
uid: wahab
sn: riyaz
givenName:: d2FoYWIg
cn: Wahab Riaz
displayName: Wahab Riaz
uidNumber: 10008
gidNumber: 5008
userPassword:: d2FoYWJsZGFw
gecos:: V2FoYWIgUmlheiA=
loginShell: /bin/bash
homeDirectory: /home/wahab

# sachin, People, example.com
dn: uid=sachin,ou=People,dc=example,dc=com
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
uid: sachin
sn: ramesh
givenName:: c2FjaGluIA==
cn: Sachin Ramesh
displayName: Sachin Ramesh
uidNumber: 10009
gidNumber: 5009
userPassword:: c2FjaGlubGRhcA==
gecos:: U2FjaGluIFJhbWVzaCA=
loginShell: /bin/bash
homeDirectory: /home/sachin

# bowlers, People, example.com
dn: cn=bowlers,ou=People,dc=example,dc=com
objectClass: groupOfNames
cn: bowlers
description: IT security group
member: cn=wahab,ou=People,dc=example,dc=com
member: cn=sachin,ou=People,dc=example,dc=com

    

Answer 1

Por exemplo, se você tiver esse grupo:

dn: cn=people-admins,ou=groups,dc=example,dc=com
objectClass: groupOfUniqueNames
cn: admins of people group
cn: people-admins
uniqueMember: uid=test1,ou=people,dc=example,dc=com
uniqueMember: uid=test2,ou=people,dc=example,dc=com

você pode imprimir todos os membros com:

ldapsearch -x -LLL -H ldap://127.0.0.1:3000/  -b dc=example,dc=com -s sub '(&(objectClass=inetOrgPerson)(memberof=cn=people-admins,ou=groups,dc=example,dc=com))' -D "cn=admin,dc=example,dc=com" -w admin uid
dn: uid=test1,ou=people,dc=example,dc=com
uid: evgeniy

dn: uid=test2,ou=people,dc=example,dc=com
uid: test2

Atualizar

No meu caso, o ldapsearch não funciona com seus dados de teste, devido a essa configuração:

# Load memberof module
dn: cn=module{0},cn=config
changetype: modify
add: olcModuleLoad
olcModuleLoad: memberof

# Backend memberOf overlay
dn: olcOverlay={0}memberof,olcDatabase={1}hdb,cn=config
changetype: add
objectClass: olcOverlayConfig
objectClass: olcMemberOf
olcOverlay: {0}memberof
olcMemberOfDangling: ignore
olcMemberOfRefInt: TRUE
olcMemberOfGroupOC: groupOfUniqueNames
olcMemberOfMemberAD: uniqueMember
olcMemberOfMemberOfAD: memberOf

Então, altero seus dados de teste para:

dn: cn=bowlers,ou=People,dc=example,dc=com
objectClass: groupOfUniqueNames
cn: bowlers
description: IT security group
uniqueMember: uid=wahab,ou=People,dc=example,dc=com
uniqueMember: uid=sachin,ou=People,dc=example,dc=com

e depois:

ldapsearch -x -LLL -H ldap://127.0.0.1:3000/  -b dc=example,dc=com -s sub '(memberof=cn=bowlers,ou=People,dc=example,dc=com)' -D "cn=admin,dc=example,dc=com" -w admin uid
dn: uid=wahab,ou=People,dc=example,dc=com
uid: wahab

dn: uid=sachin,ou=People,dc=example,dc=com
uid: sachin

para que você tenha que configurar sua memberof overlay para trabalhar com groupOfNames ou alterá-la para groupOfUniqueNames