<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Helvetica;
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:Helvetica;
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:Cambria;
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
h4
{mso-style-priority:9;
mso-style-link:"Heading 4 Char";
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman","serif";
font-weight:bold;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
code
{mso-style-priority:99;
font-family:"Courier New";}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.Heading4Char
{mso-style-name:"Heading 4 Char";
mso-style-priority:9;
mso-style-link:"Heading 4";
font-family:"Cambria","serif";
color:#4F81BD;
mso-fareast-language:EN-GB;
font-weight:bold;
font-style:italic;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;
mso-fareast-language:EN-GB;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";
mso-fareast-language:EN-GB;}
span.EmailStyle24
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle25
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.col-label
{mso-style-name:col-label;}
span.EmailStyle27
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-GB link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Is there a check list or debug routine that I can follow to get membership of groups to work correctly?<o:p></o:p></span></p><p class=MsoNormal><a name="_MailEndCompose"><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></a></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> Andy [mailto:racingyacht1@gmail.com] <br><b>Sent:</b> 05 September 2013 15:33<br><b>To:</b> 'General discussion list for the 389 Directory server project.'<br><b>Subject:</b> RE: [389-users] Membership of Roles<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>I haven’t been able to get membership of groups to work in either Liferay or blog system. The error has to be with my setup groups or the memberOf plugin. All users have objectclass inetUser. I enabled the memberOf plugin before creating the test group, and also ran the fixup script when I found that the group was not working. <o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Interestingly the blog system recognizes groups that were part of the initial installation of 389. The group that I need to recognise uniquemembers for is the group I created call blogEditorGroup.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Screenshot from blog system test of communications with ldap. Note the group = blogEditorGroup, does not recognise any of the three members created for the test. <o:p></o:p></span></p><p class=MsoNormal style='background:white'><span style='font-size:10.0pt;font-family:"Helvetica","sans-serif";color:#2B2B2B'>Search Result (max 10 entries)<o:p></o:p></span></p><table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0 width=548 style='width:411.0pt;background:white;border-collapse:collapse'><thead><tr><td width=183 style='width:137.25pt;border:solid #C0C6C9 1.0pt;border-left:none;background:#F3F3F3;padding:0cm 0cm 0cm 0cm'><p class=MsoNormal><b><span style='font-size:8.5pt'>Group Name<o:p></o:p></span></b></p></td><td width=182 style='width:136.5pt;border:solid #C0C6C9 1.0pt;border-left:none;background:#F3F3F3;padding:0cm 0cm 0cm 0cm'><p class=MsoNormal><b><span style='font-size:8.5pt'>Group Fullname<o:p></o:p></span></b></p></td><td width=181 style='width:135.75pt;border:solid #C0C6C9 1.0pt;border-left:none;background:#F3F3F3;padding:0cm 0cm 0cm 0cm'><p class=MsoNormal><b><span style='font-size:8.5pt'>Group Member<o:p></o:p></span></b></p></td></tr></thead><tr><td width=167 valign=top style='width:125.25pt;background:#FBFBFB;padding:3.75pt 6.0pt 3.75pt 6.0pt'><p class=MsoNormal style='line-height:13.5pt'><span style='font-size:10.0pt'>Directory Administrators<o:p></o:p></span></p></td><td width=167 valign=top style='width:125.25pt;background:#FBFBFB;padding:3.75pt 6.0pt 3.75pt 6.0pt'><p class=MsoNormal style='line-height:13.5pt'><span style='font-size:10.0pt'>Directory Administrators<o:p></o:p></span></p></td><td width=166 valign=top style='width:124.5pt;background:#FBFBFB;padding:3.75pt 6.0pt 3.75pt 6.0pt'><p class=MsoNormal style='line-height:13.5pt'><span style='font-size:10.0pt'>cn=Directory Manager<o:p></o:p></span></p></td></tr><tr><td width=167 valign=top style='width:125.25pt;border:solid white 1.0pt;padding:3.75pt 6.0pt 3.75pt 6.0pt'><p class=MsoNormal style='line-height:13.5pt'><span style='font-size:10.0pt'>Accounting Managers<o:p></o:p></span></p></td><td width=167 valign=top style='width:125.25pt;border:solid white 1.0pt;border-left:none;padding:3.75pt 6.0pt 3.75pt 6.0pt'><p class=MsoNormal style='line-height:13.5pt'><span style='font-size:10.0pt'>Accounting Managers<o:p></o:p></span></p></td><td width=166 valign=top style='width:124.5pt;border:solid white 1.0pt;border-left:none;padding:3.75pt 6.0pt 3.75pt 6.0pt'><p class=MsoNormal style='line-height:13.5pt'><span style='font-size:10.0pt'>cn=Directory Manager<o:p></o:p></span></p></td></tr><tr><td width=167 valign=top style='width:125.25pt;border:solid white 1.0pt;border-top:none;background:#FBFBFB;padding:3.75pt 6.0pt 3.75pt 6.0pt'><p class=MsoNormal style='line-height:13.5pt'><span style='font-size:10.0pt'>HR Managers<o:p></o:p></span></p></td><td width=167 valign=top style='width:125.25pt;border-top:none;border-left:none;border-bottom:solid white 1.0pt;border-right:solid white 1.0pt;background:#FBFBFB;padding:3.75pt 6.0pt 3.75pt 6.0pt'><p class=MsoNormal style='line-height:13.5pt'><span style='font-size:10.0pt'>HR Managers<o:p></o:p></span></p></td><td width=166 valign=top style='width:124.5pt;border-top:none;border-left:none;border-bottom:solid white 1.0pt;border-right:solid white 1.0pt;background:#FBFBFB;padding:3.75pt 6.0pt 3.75pt 6.0pt'><p class=MsoNormal style='line-height:13.5pt'><span style='font-size:10.0pt'>cn=Directory Manager<o:p></o:p></span></p></td></tr><tr><td width=167 valign=top style='width:125.25pt;border:solid white 1.0pt;border-top:none;padding:3.75pt 6.0pt 3.75pt 6.0pt'><p class=MsoNormal style='line-height:13.5pt'><span style='font-size:10.0pt'>QA Managers<o:p></o:p></span></p></td><td width=167 valign=top style='width:125.25pt;border-top:none;border-left:none;border-bottom:solid white 1.0pt;border-right:solid white 1.0pt;padding:3.75pt 6.0pt 3.75pt 6.0pt'><p class=MsoNormal style='line-height:13.5pt'><span style='font-size:10.0pt'>QA Managers<o:p></o:p></span></p></td><td width=166 valign=top style='width:124.5pt;border-top:none;border-left:none;border-bottom:solid white 1.0pt;border-right:solid white 1.0pt;padding:3.75pt 6.0pt 3.75pt 6.0pt'><p class=MsoNormal style='line-height:13.5pt'><span style='font-size:10.0pt'>cn=Directory Manager<o:p></o:p></span></p></td></tr><tr><td width=167 valign=top style='width:125.25pt;border:solid white 1.0pt;border-top:none;background:#FBFBFB;padding:3.75pt 6.0pt 3.75pt 6.0pt'><p class=MsoNormal style='line-height:13.5pt'><span style='font-size:10.0pt'>PD Managers<o:p></o:p></span></p></td><td width=167 valign=top style='width:125.25pt;border-top:none;border-left:none;border-bottom:solid white 1.0pt;border-right:solid white 1.0pt;background:#FBFBFB;padding:3.75pt 6.0pt 3.75pt 6.0pt'><p class=MsoNormal style='line-height:13.5pt'><span style='font-size:10.0pt'>PD Managers<o:p></o:p></span></p></td><td width=166 valign=top style='width:124.5pt;border-top:none;border-left:none;border-bottom:solid white 1.0pt;border-right:solid white 1.0pt;background:#FBFBFB;padding:3.75pt 6.0pt 3.75pt 6.0pt'><p class=MsoNormal style='line-height:13.5pt'><span style='font-size:10.0pt'>cn=Directory Manager<o:p></o:p></span></p></td></tr><tr><td width=167 valign=top style='width:125.25pt;border:solid white 1.0pt;border-top:none;padding:3.75pt 6.0pt 3.75pt 6.0pt'><p class=MsoNormal style='line-height:13.5pt'><span style='font-size:10.0pt'>blogEditorsGroup<o:p></o:p></span></p></td><td width=167 valign=top style='width:125.25pt;border-top:none;border-left:none;border-bottom:solid white 1.0pt;border-right:solid white 1.0pt;padding:3.75pt 6.0pt 3.75pt 6.0pt'><p class=MsoNormal style='line-height:13.5pt'><span style='font-size:10.0pt'>blogEditorsGroup<o:p></o:p></span></p></td><td style='border-top:none;border-left:none;border-bottom:solid #C0C6C9 1.0pt;border-right:solid #C0C6C9 1.0pt;padding:.75pt .75pt .75pt .75pt'></td></tr></table><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Access log:<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>[05/Sep/2013:15:15:52 +0100] conn=11 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="cn=directory manager"<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>[05/Sep/2013:15:15:52 +0100] conn=11 op=1 SRCH base="dc=xxxx,dc=com" scope=2 filter="(&(objectClass=groupOfUniqueNames))" attrs="nsUniqueId cn cn uniqueMember"<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>[05/Sep/2013:15:15:52 +0100] conn=11 op=1 RESULT err=0 tag=101 nentries=6 etime=0<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>[05/Sep/2013:15:15:52 +0100] conn=11 op=2 SRCH base="dc=xxxx,dc=com" scope=2 filter="(objectClass=*)" attrs="uid mail cn memberUid"<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>[05/Sep/2013:15:15:52 +0100] conn=11 op=2 RESULT err=4 tag=101 nentries=10 etime=0 notes=U<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>[05/Sep/2013:15:15:52 +0100] conn=11 op=3 SRCH base="dc=xxxx,dc=com" scope=2 filter="(|(uniqueMember=))" attrs="cn cn"<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>[05/Sep/2013:15:15:52 +0100] conn=11 op=3 RESULT err=0 tag=101 nentries=0 etime=0<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>[05/Sep/2013:15:15:52 +0100] conn=11 op=4 SRCH base="dc=xxxx,dc=com" scope=2 filter="(|(uniqueMember=))" attrs="cn cn"<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>[05/Sep/2013:15:15:52 +0100] conn=11 op=4 RESULT err=0 tag=101 nentries=0 etime=0<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>[05/Sep/2013:15:15:52 +0100] conn=11 op=5 SRCH base="dc=xxxx,dc=com" scope=2 filter="(|(uniqueMember=))" attrs="cn cn"<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>[05/Sep/2013:15:15:52 +0100] conn=11 op=5 RESULT err=0 tag=101 nentries=0 etime=0<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>[05/Sep/2013:15:15:52 +0100] conn=11 op=6 SRCH base="dc=xxxx,dc=com" scope=2 filter="(|(uniqueMember=))" attrs="cn cn"<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>[05/Sep/2013:15:15:52 +0100] conn=11 op=6 RESULT err=0 tag=101 nentries=0 etime=0<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>[05/Sep/2013:15:15:52 +0100] conn=11 op=7 SRCH base="dc=xxxx,dc=com" scope=2 filter="(|(uniqueMember=))" attrs="cn cn"<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>[05/Sep/2013:15:15:52 +0100] conn=11 op=7 RESULT err=0 tag=101 nentries=0 etime=0<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>[05/Sep/2013:15:15:52 +0100] conn=11 op=8 SRCH base="dc=xxxx,dc=com" scope=2 filter="(|(uniqueMember=))" attrs="cn cn"<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>[05/Sep/2013:15:15:52 +0100] conn=11 op=8 RESULT err=0 tag=101 nentries=0 etime=0<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>[05/Sep/2013:15:15:52 +0100] conn=11 op=9 SRCH base="dc=xxxx,dc=com" scope=2 filter="(|(uniqueMember=))" attrs="cn cn"<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>[05/Sep/2013:15:15:52 +0100] conn=11 op=9 RESULT err=0 tag=101 nentries=0 etime=0<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>[05/Sep/2013:15:15:52 +0100] conn=11 op=10 SRCH base="dc=xxxx,dc=com" scope=2 filter="(|(uniqueMember=))" attrs="cn cn"<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>[05/Sep/2013:15:15:52 +0100] conn=11 op=10 RESULT err=0 tag=101 nentries=0 etime=0<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>[05/Sep/2013:15:15:52 +0100] conn=11 op=11 SRCH base="dc=xxxx,dc=com" scope=2 filter="(|(uniqueMember=))" attrs="cn cn"<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>[05/Sep/2013:15:15:52 +0100] conn=11 op=11 RESULT err=0 tag=101 nentries=0 etime=0<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>[05/Sep/2013:15:15:52 +0100] conn=11 op=12 SRCH base="dc=xxxx,dc=com" scope=2 filter="(|(uniqueMember=))" attrs="cn cn"<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>[05/Sep/2013:15:15:52 +0100] conn=11 op=12 RESULT err=0 tag=101 nentries=0 etime=0<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>[05/Sep/2013:15:15:52 +0100] conn=11 op=-1 fd=67 closed - B1<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>[05/Sep/2013:15:17:12 +0100] conn=12 fd=67 slot=67 connection from 192.168.20.38 to 192.168.20.28<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>[05/Sep/2013:15:17:12 +0100] conn=12 op=0 BIND dn="cn=Directory Manager" method=128 version=3<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>[05/Sep/2013:15:17:12 +0100] conn=12 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="cn=directory manager"<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>[05/Sep/2013:15:17:12 +0100] conn=12 op=1 SRCH base="dc=xxxx,dc=com" scope=2 filter="(objectClass=inetOrgPerson)" attrs="cn"<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>[05/Sep/2013:15:17:12 +0100] conn=12 op=1 RESULT err=0 tag=101 nentries=4 etime=0 notes=P<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>[05/Sep/2013:15:17:12 +0100] conn=12 op=2 SRCH base="cn=Test user1+uid=100001,ou=People,dc=xxxx,dc=com" scope=0 filter="(objectClass=*)" attrs="uid cn mail cn nsRole title givenName userPassword sn creatorsName createTimestamp modifiersName modifyTimestamp"<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>[05/Sep/2013:15:17:12 +0100] conn=12 op=2 RESULT err=0 tag=101 nentries=1 etime=0<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>[05/Sep/2013:15:17:12 +0100] conn=12 op=3 SRCH base="uid=100000001,ou=People,dc=xxxx,dc=com" scope=0 filter="(objectClass=*)" attrs="uid cn mail cn nsRole title givenName userPassword sn creatorsName createTimestamp modifiersName modifyTimestamp"<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>[05/Sep/2013:15:17:12 +0100] conn=12 op=3 RESULT err=0 tag=101 nentries=1 etime=0<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>[05/Sep/2013:15:17:12 +0100] conn=12 op=4 SRCH base="uid=100002,ou=People,dc=xxxx,dc=com" scope=0 filter="(objectClass=*)" attrs="uid cn mail cn nsRole title givenName userPassword sn creatorsName createTimestamp modifiersName modifyTimestamp"<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>[05/Sep/2013:15:17:12 +0100] conn=12 op=4 RESULT err=0 tag=101 nentries=1 etime=0<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>[05/Sep/2013:15:17:12 +0100] conn=12 op=5 SRCH base="uid=100003,ou=People,dc=xxxx,dc=com" scope=0 filter="(objectClass=*)" attrs="uid cn mail cn nsRole title givenName userPassword sn creatorsName createTimestamp modifiersName modifyTimestamp"<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>[05/Sep/2013:15:17:12 +0100] conn=12 op=5 RESULT err=0 tag=101 nentries=1 etime=0<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> Andy [<a href="mailto:racingyacht1@gmail.com">mailto:racingyacht1@gmail.com</a>] <br><b>Sent:</b> 03 September 2013 22:23<br><b>To:</b> 'General discussion list for the 389 Directory server project.'<br><b>Subject:</b> RE: [389-users] Membership of Roles<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Jonathan,<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>That could be the root of the groups issue. I enabled the memberOf plugin after creating the groups and users.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>I will be testing in a few minutes. <o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> <a href="mailto:389-users-bounces@lists.fedoraproject.org">389-users-bounces@lists.fedoraproject.org</a> [<a href="mailto:389-users-bounces@lists.fedoraproject.org">mailto:389-users-bounces@lists.fedoraproject.org</a>] <b>On Behalf Of </b>Jonathan Vaughn<br><b>Sent:</b> 03 September 2013 22:02<br><b>To:</b> General discussion list for the 389 Directory server project.<br><b>Subject:</b> Re: [389-users] Membership of Roles<o:p></o:p></span></p><p class=MsoNormal><o:p> </o:p></p><div><p class=MsoNormal>If you had your users and groups created before enabling memberOf, you'll need to modify their group membership (per user, easiest would be to add all to a temporary group then remove the group after memberOf populates) to trigger memberOf creation. It only gets set on changes, and won't autogenerate for existing memberships until a change occurs. It WILL regenerate all memberships even if you change just one, so you can just throw everyone into a group as I said to trigger it. There was a script in some FDS / 389DS howto someplace that was supposed to background trigger it, but I never got it to work.<o:p></o:p></p></div><div><p class=MsoNormal style='margin-bottom:12.0pt'><o:p> </o:p></p><div><p class=MsoNormal>On Tue, Sep 3, 2013 at 3:47 PM, Andy <<a href="mailto:racingyacht1@gmail.com" target="_blank">racingyacht1@gmail.com</a>> wrote:<o:p></o:p></p><div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='color:#1F497D'>Hi Rich,</span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='color:#1F497D'>I had added the inetUser objectclass on the test cases of groups that failed. I was wondering if I had incorrectly configured arguments of the memberOf plugin. I will read the documentation again.</span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='color:#1F497D'> </span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='color:#1F497D'>I should be done rebuilding my instance of 389 in an hour or so. </span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><a name="140e594e6a5e1b01__MailEndCompose"><span style='color:#1F497D'> </span></a><o:p></o:p></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> Rich Megginson [mailto:<a href="mailto:rmeggins@redhat.com" target="_blank">rmeggins@redhat.com</a>] <br><b>Sent:</b> 03 September 2013 20:47<br><b>To:</b> Andy<br><b>Cc:</b> 'General discussion list for the 389 Directory server project.'</span><o:p></o:p></p><div><div><p class=MsoNormal><br><b>Subject:</b> Re: [389-users] Membership of Roles<o:p></o:p></p></div></div></div></div><div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>On 09/03/2013 01:22 PM, Andy wrote:<o:p></o:p></p></div><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='color:#1F497D'>Hi Rich,</span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='color:#1F497D'>I am having the same problem with groups, so I am wondering if I have groups configured correctly. Especially the configuration of the memberOf plugin. </span><o:p></o:p></p></blockquote><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><br><a href="https://access.redhat.com/site/documentation/en-US/Red_Hat_Directory_Server/9.0/html/Administration_Guide/Advanced_Entry_Management.html#groups-cmd-memberof" target="_blank">https://access.redhat.com/site/documentation/en-US/Red_Hat_Directory_Server/9.0/html/Administration_Guide/Advanced_Entry_Management.html#groups-cmd-memberof</a><br><br>Especially this part: <o:p></o:p></p><div><div><div><div><h4>6.1.4.2. Object Classes Which Support memberof Attributes<o:p></o:p></h4></div></div></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>The most common people object classes — such as <code><span style='font-size:10.0pt'>inetorgperson</span></code> and <code><span style='font-size:10.0pt'>person</span></code> — do not allow the <code><i><span style='font-size:10.0pt'>memberOf</span></i></code> attribute. To allow the MemberOf Plug-in to add the <code><i><span style='font-size:10.0pt'>memberOf</span></i></code> attribute to a user entry, make sure that that entry belongs to the <code><span style='font-size:10.0pt'>inetUser</span></code> object class, which does allow the <code><i><span style='font-size:10.0pt'>memberOf</span></i></code> attribute. <o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Similarly, if an attribute other than <code><i><span style='font-size:10.0pt'>memberOf</span></i></code> is used in the user entry, then make sure that the user entry belongs to an object class that allows that attribute. <o:p></o:p></p></div></div><p class=MsoNormal style='mso-margin-top-alt:auto;margin-bottom:12.0pt'><o:p> </o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='color:#1F497D'>I’m in the process of reconfiguring my instance of ldap, as it was misbehaving after I tried out various configuration to get roles and groups to work. </span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='color:#1F497D'> </span><o:p></o:p></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> Rich Megginson [<a href="mailto:rmeggins@redhat.com" target="_blank">mailto:rmeggins@redhat.com</a>] <br><b>Sent:</b> 03 September 2013 14:48<br><b>To:</b> General discussion list for the 389 Directory server project.<br><b>Cc:</b> Andy<br><b>Subject:</b> Re: [389-users] Membership of Roles</span><o:p></o:p></p></div></div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>On 09/01/2013 05:50 AM, Andy wrote:<o:p></o:p></p></div><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='color:#1F497D'>Please find additional information on the configuration of the blog system</span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='color:#1F497D'> </span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='color:#1F497D'>My configuration:</span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='color:#1F497D'> </span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='color:#1F497D'>AuthenticationModule LDAP</span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='color:#1F497D'>LDAPAuthURL ldap://xxxxx:389/dc=xxxx,dc=com?mail</span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='color:#1F497D'>LDAPAuthBindDN cn=Directory Manager (will replace with application user account once phase one integration is completed)</span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='color:#1F497D'>LDAPAuthPassword xxxxxx</span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='color:#1F497D'>LDAPAuthSASLMechanism PLAIN (note SSL not yet configured)</span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='color:#1F497D'>ExternalUserManagement 1</span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='color:#1F497D'>ExternalGroupManagement 1</span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='color:#1F497D'>ExternalUserSyncFrequency 60</span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='color:#1F497D'>LDAPGroupNameAttribute cn</span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='color:#1F497D'>LDAPGroupIdAttribute nsUniqueId</span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='color:#1F497D'>LDAPGroupFullNameAttribute cn</span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='color:#1F497D'>LDAPGroupMemberAttribute memberof</span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='color:#1F497D'>LDAPGroupSearchBase ou=customers,dc=xxx,dc=com</span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='color:#1F497D'>LDAPGroupFilter (objectclass=ldapSubEntry)</span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='color:#1F497D'>LDAPUserIdAttribute uid</span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='color:#1F497D'>LDAPUserEmailAttribute mail</span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='color:#1F497D'>LDAPUserFullNameAttribute cn</span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='color:#1F497D'>LDAPUserGroupMemberAttribute nsrole</span><o:p></o:p></p></blockquote><p class=MsoNormal style='mso-margin-top-alt:auto;margin-bottom:12.0pt'><br>I think this is going to be problematic, and may not work at all. With groups, there is an actual group entry, which lists all of the members. With roles, the role entry does not list all of the members. So a query like<br>SRCH base="ou=customers,dc=xxxx,dc=com" scope=2 filter="(&(|(member=cn=xxxxrolecommentertest,ou=customers,dc=xxxx,dc=com))(objectClass=ldapSubEntry))"<br><br>will not work because there is no role entry which lists it's members in a "member" attribute.<br><br>If you can configure it to search all of the users, you might be able to do a search like<br><br>SRCH base="ou=customers,dc=xxxx,dc=com" scope=2 filter="(nsRole=cn=xxxxrolecommentertest,ou=customers,dc=xxxx,dc=com)"<br><br>Roles will automatically populate each user's entry with the nsRole attribute. This attribute lists all of the roles to which that user belongs. nsRole is an operational attribute, so you must explicitly request it on the command line if you want to see it (e.g. in an ldapsearch command).<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='color:#1F497D'> </span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='color:#1F497D'>The default settings for OpenLDAP installations are:</span><o:p></o:p></p><table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0 style='border-collapse:collapse'><thead><tr><td valign=top style='border:solid #DDDDDD 1.0pt;background:#F0F0F0;padding:3.75pt 11.25pt 3.75pt 5.25pt'><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;line-height:13.0pt'><b><span style='font-size:10.0pt'>Stage 1</span></b><o:p></o:p></p></td><td valign=top style='border:solid #DDDDDD 1.0pt;border-left:none;background:#F0F0F0;padding:3.75pt 11.25pt 3.75pt 5.25pt'><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;line-height:13.0pt'><b><span style='font-size:10.0pt'> </span></b><o:p></o:p></p></td></tr></thead><tr><td valign=top style='border:solid #DDDDDD 1.0pt;border-top:none;padding:3.75pt 5.25pt 3.75pt 5.25pt'><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;line-height:13.0pt'><b><span style='font-size:10.0pt'>Authentication URL</span></b><o:p></o:p></p></td><td valign=top style='border-top:none;border-left:none;border-bottom:solid #DDDDDD 1.0pt;border-right:solid #DDDDDD 1.0pt;padding:3.75pt 5.25pt 3.75pt 5.25pt'><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;line-height:13.0pt'><span style='font-size:10.0pt'>ldap://<FQDN of LDAP server>:389/dc=xxxx,dc=com?mail</span><o:p></o:p></p></td></tr><tr><td valign=top style='border:solid #DDDDDD 1.0pt;border-top:none;padding:3.75pt 5.25pt 3.75pt 5.25pt'><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;line-height:13.0pt'><b><span style='font-size:10.0pt'>Authentication DN</span></b><o:p></o:p></p></td><td valign=top style='border-top:none;border-left:none;border-bottom:solid #DDDDDD 1.0pt;border-right:solid #DDDDDD 1.0pt;padding:3.75pt 5.25pt 3.75pt 5.25pt'></td></tr><tr><td valign=top style='border:solid #DDDDDD 1.0pt;border-top:none;padding:3.75pt 5.25pt 3.75pt 5.25pt'><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;line-height:13.0pt'><b><span style='font-size:10.0pt'>Authentication Password</span></b><o:p></o:p></p></td><td valign=top style='border-top:none;border-left:none;border-bottom:solid #DDDDDD 1.0pt;border-right:solid #DDDDDD 1.0pt;padding:3.75pt 5.25pt 3.75pt 5.25pt'><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;line-height:13.0pt'><span style='font-size:10.0pt'>Password </span><o:p></o:p></p></td></tr><tr><td valign=top style='border:solid #DDDDDD 1.0pt;border-top:none;padding:3.75pt 5.25pt 3.75pt 5.25pt'><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;line-height:13.0pt'><b><span style='font-size:10.0pt'>Test Username</span></b><o:p></o:p></p></td><td valign=top style='border-top:none;border-left:none;border-bottom:solid #DDDDDD 1.0pt;border-right:solid #DDDDDD 1.0pt;padding:3.75pt 5.25pt 3.75pt 5.25pt'><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;line-height:13.0pt'><span style='font-size:10.0pt'>Test email address</span><o:p></o:p></p></td></tr><tr><td valign=top style='border:solid #DDDDDD 1.0pt;border-top:none;padding:3.75pt 5.25pt 3.75pt 5.25pt'><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;line-height:13.0pt'><b><span style='font-size:10.0pt'>Test Password</span></b><o:p></o:p></p></td><td valign=top style='border-top:none;border-left:none;border-bottom:solid #DDDDDD 1.0pt;border-right:solid #DDDDDD 1.0pt;padding:3.75pt 5.25pt 3.75pt 5.25pt'><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;line-height:13.0pt'><span style='font-size:10.0pt'>Password for test user</span><o:p></o:p></p></td></tr></table><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='color:#1F497D'> </span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='color:#1F497D'> </span><o:p></o:p></p><table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0 style='border-collapse:collapse'><thead><tr><td valign=top style='border:solid #DDDDDD 1.0pt;background:#F0F0F0;padding:3.75pt 11.25pt 3.75pt 5.25pt'><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;line-height:13.0pt'><b><span style='font-size:10.0pt'>Stage 2</span></b><o:p></o:p></p></td><td valign=top style='border:solid #DDDDDD 1.0pt;border-left:none;background:#F0F0F0;padding:3.75pt 11.25pt 3.75pt 5.25pt'><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;line-height:13.0pt'><b><span style='font-size:10.0pt'> </span></b><o:p></o:p></p></td></tr></thead><tr><td valign=top style='border:solid #DDDDDD 1.0pt;border-top:none;padding:3.75pt 5.25pt 3.75pt 5.25pt'><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;line-height:13.0pt'><span style='font-size:10.0pt'>Group Search Base Attribute</span><o:p></o:p></p></td><td valign=top style='border-top:none;border-left:none;border-bottom:solid #DDDDDD 1.0pt;border-right:solid #DDDDDD 1.0pt;padding:3.75pt 5.25pt 3.75pt 5.25pt'><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;line-height:13.0pt'><span style='font-size:10.0pt'>dc=xxx,dc=com</span><o:p></o:p></p></td></tr><tr><td valign=top style='border:solid #DDDDDD 1.0pt;border-top:none;padding:3.75pt 5.25pt 3.75pt 5.25pt'><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;line-height:13.0pt'><span style='font-size:10.0pt'>Group Filter Attribute</span><o:p></o:p></p></td><td valign=top style='border-top:none;border-left:none;border-bottom:solid #DDDDDD 1.0pt;border-right:solid #DDDDDD 1.0pt;padding:3.75pt 5.25pt 3.75pt 5.25pt'><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;line-height:13.0pt'><span style='font-size:10.0pt;font-family:"Arial","sans-serif";color:#333333;background:white'>(objectClass=groupOfUniqueNames)</span><o:p></o:p></p></td></tr></table><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='color:#1F497D'> </span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='color:#1F497D'> </span><o:p></o:p></p><table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0 style='border-collapse:collapse'><thead><tr><td valign=top style='border:solid #DDDDDD 1.0pt;background:#F0F0F0;padding:3.75pt 11.25pt 3.75pt 5.25pt'><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;line-height:13.0pt'><b><span style='font-size:10.0pt'>Attributes</span></b><o:p></o:p></p></td><td valign=top style='border:solid #DDDDDD 1.0pt;border-left:none;background:#F0F0F0;padding:3.75pt 11.25pt 3.75pt 5.25pt'><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;line-height:13.0pt'><b><span style='font-size:10.0pt'>OpenLDAP</span></b><o:p></o:p></p></td></tr></thead><tr><td valign=top style='border:solid #DDDDDD 1.0pt;border-top:none;padding:3.75pt 5.25pt 3.75pt 5.25pt'><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;line-height:13.0pt'><span style='font-size:10.0pt'>User ID Attribute</span><o:p></o:p></p></td><td valign=top style='border-top:none;border-left:none;border-bottom:solid #DDDDDD 1.0pt;border-right:solid #DDDDDD 1.0pt;padding:3.75pt 5.25pt 3.75pt 5.25pt'><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;line-height:13.0pt'><span style='font-size:10.0pt'>entryUUID</span><o:p></o:p></p></td></tr><tr><td valign=top style='border:solid #DDDDDD 1.0pt;border-top:none;padding:3.75pt 5.25pt 3.75pt 5.25pt'><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;line-height:13.0pt'><span style='font-size:10.0pt'>Email Attribute</span><o:p></o:p></p></td><td valign=top style='border-top:none;border-left:none;border-bottom:solid #DDDDDD 1.0pt;border-right:solid #DDDDDD 1.0pt;padding:3.75pt 5.25pt 3.75pt 5.25pt'><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;line-height:13.0pt'><span style='font-size:10.0pt'>mail</span><o:p></o:p></p></td></tr><tr><td valign=top style='border:solid #DDDDDD 1.0pt;border-top:none;padding:3.75pt 5.25pt 3.75pt 5.25pt'><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;line-height:13.0pt'><span style='font-size:10.0pt'>User Fullname Attribute</span><o:p></o:p></p></td><td valign=top style='border-top:none;border-left:none;border-bottom:solid #DDDDDD 1.0pt;border-right:solid #DDDDDD 1.0pt;padding:3.75pt 5.25pt 3.75pt 5.25pt'><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;line-height:13.0pt'><span style='font-size:10.0pt'>cn</span><o:p></o:p></p></td></tr><tr><td valign=top style='border:solid #DDDDDD 1.0pt;border-top:none;padding:3.75pt 5.25pt 3.75pt 5.25pt'><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;line-height:13.0pt'><span style='font-size:10.0pt'>User Member Attribute</span><o:p></o:p></p></td><td valign=top style='border-top:none;border-left:none;border-bottom:solid #DDDDDD 1.0pt;border-right:solid #DDDDDD 1.0pt;padding:3.75pt 5.25pt 3.75pt 5.25pt'><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;line-height:13.0pt'><span style='font-size:10.0pt'>uid</span><o:p></o:p></p></td></tr><tr><td valign=top style='border:solid #DDDDDD 1.0pt;border-top:none;padding:3.75pt 5.25pt 3.75pt 5.25pt'><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;line-height:13.0pt'><span style='font-size:10.0pt'>GroupID Attribute</span><o:p></o:p></p></td><td valign=top style='border-top:none;border-left:none;border-bottom:solid #DDDDDD 1.0pt;border-right:solid #DDDDDD 1.0pt;padding:3.75pt 5.25pt 3.75pt 5.25pt'><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;line-height:13.0pt'><span style='font-size:10.0pt'>entryUUID</span><o:p></o:p></p></td></tr><tr><td valign=top style='border:solid #DDDDDD 1.0pt;border-top:none;padding:3.75pt 5.25pt 3.75pt 5.25pt'><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;line-height:13.0pt'><span style='font-size:10.0pt'>Group Name Attribute</span><o:p></o:p></p></td><td valign=top style='border-top:none;border-left:none;border-bottom:solid #DDDDDD 1.0pt;border-right:solid #DDDDDD 1.0pt;padding:3.75pt 5.25pt 3.75pt 5.25pt'><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;line-height:13.0pt'><span style='font-size:10.0pt'>cn</span><o:p></o:p></p></td></tr><tr><td valign=top style='border:solid #DDDDDD 1.0pt;border-top:none;padding:3.75pt 5.25pt 3.75pt 5.25pt'><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;line-height:13.0pt'><span style='font-size:10.0pt'>Group Fullname Attribute</span><o:p></o:p></p></td><td valign=top style='border-top:none;border-left:none;border-bottom:solid #DDDDDD 1.0pt;border-right:solid #DDDDDD 1.0pt;padding:3.75pt 5.25pt 3.75pt 5.25pt'><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;line-height:13.0pt'><span style='font-size:10.0pt'>cn</span><o:p></o:p></p></td></tr><tr><td valign=top style='border:solid #DDDDDD 1.0pt;border-top:none;padding:3.75pt 5.25pt 3.75pt 5.25pt'><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;line-height:13.0pt'><span style='font-size:10.0pt'>Group Member Attribute</span><o:p></o:p></p></td><td valign=top style='border-top:none;border-left:none;border-bottom:solid #DDDDDD 1.0pt;border-right:solid #DDDDDD 1.0pt;padding:3.75pt 5.25pt 3.75pt 5.25pt'><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;line-height:13.0pt'><span style='font-size:10.0pt'>memberUid</span><o:p></o:p></p></td></tr></table><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='color:#1F497D'> </span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='color:#1F497D'> </span><o:p></o:p></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> Andy [<a href="mailto:racingyacht1@gmail.com" target="_blank">mailto:racingyacht1@gmail.com</a>] <br><b>Sent:</b> 31 August 2013 13:43<br><b>To:</b> '<a href="mailto:389-users@lists.fedoraproject.org" target="_blank">389-users@lists.fedoraproject.org</a>'<br><b>Subject:</b> Membership of Roles</span><o:p></o:p></p></div></div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Hello<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>I am testing integration of 389-ds with a blogging system. I plan to use roles instead of groups to automatically give users rights to service on the blog system. However, I am having problems with the system identifying members of roles. I need help with defining the correct search parameters to identify which roles a uid or cn is a member of.<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>From within the blog system I’m using LDAPGroupFilter (objectclass=ldapSubEntry) to list the roles. The roles list correctly as groups within the blog system. <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>From within 389 the members of roles are configured as filtered, and I can see the configured members using the Directory Server GUI.<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>The blog system is not identifying members of roles when it does its search against 389. Note, users can log into the blog system using the accounts created on 389. I don’t think I am applying the correct search criteria to identify group membership. I need advice on creation of the correct search criteria for membership of roles/groups. <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Sample log from access<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>[31/Aug/2013:11:09:39 +0100] conn=265 op=0 BIND dn="cn=Directory Manager" method=128 version=3<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>[31/Aug/2013:11:09:39 +0100] conn=265 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="cn=directory manager"<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>[31/Aug/2013:11:09:39 +0100] conn=265 op=1 SRCH base="dc=xxxx,dc=com" scope=2 filter="(&(<a href="mailto:mail=testuser16@xxxx.com%29%28objectClass=*%29%29" target="_blank">mail=testuser16@xxxx.com)(objectClass=*))</a>" attrs="distinguishedName"<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>[31/Aug/2013:11:09:39 +0100] conn=265 op=1 RESULT err=0 tag=101 nentries=1 etime=0<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>[31/Aug/2013:11:09:39 +0100] conn=265 op=2 BIND dn="uid=1000016,ou=Customers,dc=xxxx,dc=com" method=128 version=3<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>[31/Aug/2013:11:09:39 +0100] conn=265 op=2 RESULT err=0 tag=97 nentries=0 etime=0 dn="uid=1000016,ou=customers,dc=xxxx,dc=com"<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>[31/Aug/2013:11:09:39 +0100] conn=265 op=3 BIND dn="cn=Directory Manager" method=128 version=3<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>[31/Aug/2013:11:09:39 +0100] conn=265 op=3 RESULT err=0 tag=97 nentries=0 etime=0 dn="cn=directory manager"<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>[31/Aug/2013:11:09:39 +0100] conn=265 op=4 SRCH base="dc=xxxx,dc=com" scope=2 filter="(&(<a href="mailto:mail=testuser16@xxxx.com%29%28objectClass=*%29%29" target="_blank">mail=testuser16@xxxx.com)(objectClass=*))</a>" attrs="uid mail cn mail distinguishedName"<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>[31/Aug/2013:11:09:39 +0100] conn=265 op=4 RESULT err=0 tag=101 nentries=1 etime=0<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>[31/Aug/2013:11:09:39 +0100] conn=265 op=5 SRCH base="dc=xxxx,dc=com" scope=2 filter="(|(uid=1000016))" attrs="nsRole"<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>[31/Aug/2013:11:09:39 +0100] conn=265 op=5 RESULT err=0 tag=101 nentries=1 etime=0<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>[31/Aug/2013:11:09:39 +0100] conn=265 op=6 SRCH base="ou=customers,dc=xxxx,dc=com" scope=2 filter="(&(|(member=cn=xxxxrolecommentertest,ou=customers,dc=xxxx,dc=com))(objectClass=ldapSubEntry))" attrs="cn cn member nsUniqueId"<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>[31/Aug/2013:11:09:39 +0100] conn=265 op=6 RESULT err=0 tag=101 nentries=0 etime=0<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>[31/Aug/2013:11:09:39 +0100] conn=265 op=7 UNBIND<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>[31/Aug/2013:11:09:39 +0100] conn=265 op=7 fd=68 closed - U1<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;margin-bottom:12.0pt'><o:p> </o:p></p><pre>--<o:p></o:p></pre><pre>389 users mailing list<o:p></o:p></pre><pre><a href="mailto:389-users@lists.fedoraproject.org" target="_blank">389-users@lists.fedoraproject.org</a><o:p></o:p></pre><pre><a href="https://admin.fedoraproject.org/mailman/listinfo/389-users" target="_blank">https://admin.fedoraproject.org/mailman/listinfo/389-users</a><o:p></o:p></pre><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p></div></div></div></div><p class=MsoNormal><br>--<br>389 users mailing list<br><a href="mailto:389-users@lists.fedoraproject.org">389-users@lists.fedoraproject.org</a><br><a href="https://admin.fedoraproject.org/mailman/listinfo/389-users" target="_blank">https://admin.fedoraproject.org/mailman/listinfo/389-users</a><o:p></o:p></p></div><p class=MsoNormal><o:p> </o:p></p></div></div></body></html>