getent group doesnt show any ldap groups

[Rick Dicaire]

Hi folks...I've created a group, named it guitar. I execute getent
group guitar, and nothing returns.
I added a user, and added the user to this group. I execute getent
passwd username, and the uid and gid I set shows, not the group name I
added the user to.

graz:*:1200:1200:graz:/home/graz:/bin/bash

id user shows
uid=1200(graz) gid=1200 groups=1200

Why doesn't the group I'd added the user to show?

-- 
aRDy Music and Rick Dicaire present:
http://www.ardynet.com
http://www.ardynet.com:9000/ardymusic.ogg.m3u

[John A. Sullivan III]

On Tue, 2010-05-04 at 00:56 -0400, Rick Dicaire wrote:
>  Hi folks...I've created a group, named it guitar. I execute
> getent
>  group guitar, and nothing returns.
>  I added a user, and added the user to this group. I execute getent
>  passwd username, and the uid and gid I set shows, not the group name I
>  added the user to.
>  
>  graz:*:1200:1200:graz:/home/graz:/bin/bash
>  
>  id user shows
>  uid=1200(graz) gid=1200 groups=1200
>  
>  Why doesn't the group I'd added the user to show?
>   
I do not know if it is the same issue but I found I had to add the
posixgroup objectclass to the group; I had to add the memberuid
attribute and then I had to manually add the uids as values to that
attribute.  I've not filed an RFE bug but it would be nice if the
memberuid attribute populated by grabbing the uid value (if set) of any
added uniquemembers.  Hope that helps - John

[Rick Dicaire]

On Tue, May 4, 2010 at 7:07 AM, John A. Sullivan III
<jsullivan(a)opensourcedevel.com&gt; wrote:
>  I do not know if it is the same issue but I found I had to add the
>  posixgroup objectclass to the group; I had to add the memberuid
>  attribute and then I had to manually add the uids as values to that
>  attribute.  I've not filed an RFE bug but it would be nice if the
>  memberuid attribute populated by grabbing the uid value (if set) of any
>  added uniquemembers.  Hope that helps - John 
Thanks John, can you detail how you did this? Thanks

-- 
aRDy Music and Rick Dicaire present:
http://www.ardynet.com
http://www.ardynet.com:9000/ardymusic.ogg.m3u

[John A. Sullivan III]

On Tue, 2010-05-04 at 09:33 -0400, Rick Dicaire wrote:
>  On Tue, May 4, 2010 at 7:07 AM, John A. Sullivan III
>  <jsullivan(a)opensourcedevel.com&gt; wrote:
>  > I do not know if it is the same issue but I found I had to add the
>  > posixgroup objectclass to the group; I had to add the memberuid
>  > attribute and then I had to manually add the uids as values to that
>  > attribute.  I've not filed an RFE bug but it would be nice if the
>  > memberuid attribute populated by grabbing the uid value (if set) of any
>  > added uniquemembers.  Hope that helps - John
>  
>  Thanks John, can you detail how you did this? Thanks
>   
Sure - go to the advanced properties of the group.  Look at the
objectclass attribute.  If it does not contain posixgroup (I believe
that's the correct value - I'm not looking at my 389 right now), click
in the list of values and then click add value.  Choose posixgroup from
the list.

Then click on add attribute and choose memberuid from the list.  There
will be a blank field for memberuid.  Enter the first uid.  To enter
additional uids, click add value and enter the new uid - John

[Rick Dicaire]

On Tue, May 4, 2010 at 7:31 PM, John A. Sullivan III
<jsullivan(a)opensourcedevel.com&gt; wrote:
>  Sure - go to the advanced properties of the group.  Look at the
>  objectclass attribute.  If it does not contain posixgroup (I believe
>  that's the correct value - I'm not looking at my 389 right now), click
>  in the list of values and then click add value.  Choose posixgroup from
>  the list.
>
>  Then click on add attribute and choose memberuid from the list.  There
>  will be a blank field for memberuid.  Enter the first uid.  To enter
>  additional uids, click add value and enter the new uid - John 
John, thanks, this is great....I decided to try something based on
this. Since both users I'd added have the same gid, I noticed a
gidnumber field was added when I added posixgroup to Object class. I
set this fields value to that of the users gid. I removed the
previously added memberuid attribute that had the uid vaules of the
two users:

ardy@daw1~$ getent group guitar
guitar:*:1200:graz,mraz
ardy@daw1~$ id graz
uid=1200(graz) gid=1200(guitar) groups=1200(guitar)
ardy@daw1~$ id mraz
uid=1201(mraz) gid=1200(guitar) groups=1200(guitar)

Seems to me, at this juncture, its unnecessary to add the memberuid
attribute and fill it with uid values?

Some more experimenting, added another group, added posixgroup to
Object class, set the gidnumber for the group, added the same two
users to it:

ardy@daw1~$ getent group amplifier
amplifier:*:1201:graz,mraz
ardy@daw1~$ id graz
uid=1200(graz) gid=1200(guitar) groups=1200(guitar),1201(amplifier)
ardy@daw1~$ id mraz
uid=1201(mraz) gid=1200(guitar) groups=1200(guitar),1201(amplifier)

Now, while getent shows all groups for a user, is there a way to see
all the groups a specific user is in with 389-console, I'm not seeing
any secondary groups in advanced properties for the user.

Thanks again John, this really helped!

-- 
aRDy Music and Rick Dicaire present:
http://www.ardynet.com
http://www.ardynet.com:9000/ardymusic.ogg.m3u

[John A. Sullivan III]

On Tue, 2010-05-04 at 20:13 -0400, Rick Dicaire wrote:
>  On Tue, May 4, 2010 at 7:31 PM, John A. Sullivan III
>  <jsullivan(a)opensourcedevel.com&gt; wrote:
>  > Sure - go to the advanced properties of the group.  Look at the
>  > objectclass attribute.  If it does not contain posixgroup (I believe
>  > that's the correct value - I'm not looking at my 389 right now), click
>  > in the list of values and then click add value.  Choose posixgroup from
>  > the list.
>  >
>  > Then click on add attribute and choose memberuid from the list.  There
>  > will be a blank field for memberuid.  Enter the first uid.  To enter
>  > additional uids, click add value and enter the new uid - John
>  
>  John, thanks, this is great....I decided to try something based on
>  this. Since both users I'd added have the same gid, I noticed a
>  gidnumber field was added when I added posixgroup to Object class. I
>  set this fields value to that of the users gid. I removed the
>  previously added memberuid attribute that had the uid vaules of the
>  two users:
>  
>  ardy@daw1~$ getent group guitar
>  guitar:*:1200:graz,mraz
>  ardy@daw1~$ id graz
>  uid=1200(graz) gid=1200(guitar) groups=1200(guitar)
>  ardy@daw1~$ id mraz
>  uid=1201(mraz) gid=1200(guitar) groups=1200(guitar)
>  
>  Seems to me, at this juncture, its unnecessary to add the memberuid
>  attribute and fill it with uid values?
>  
>  Some more experimenting, added another group, added posixgroup to
>  Object class, set the gidnumber for the group, added the same two
>  users to it:
>  
>  ardy@daw1~$ getent group amplifier
>  amplifier:*:1201:graz,mraz
>  ardy@daw1~$ id graz
>  uid=1200(graz) gid=1200(guitar) groups=1200(guitar),1201(amplifier)
>  ardy@daw1~$ id mraz
>  uid=1201(mraz) gid=1200(guitar) groups=1200(guitar),1201(amplifier)
>  
>  Now, while getent shows all groups for a user, is there a way to see
>  all the groups a specific user is in with 389-console, I'm not seeing
>  any secondary groups in advanced properties for the user.
>  
>  Thanks again John, this really helped!
>   
I'm pulling this out of memory so you may want to verify it.  We do have
a memberof attribute for our users.  I believe it is populated via a
memberof plugin.  There is documentation on it.  We implemented it when
it was first released and it was a little temperamental.  I don't recall
all the issues off-hand but I think it required the users to have an
objectclass which was not added by default - perhaps inetuser.  In any
event, there is good documentation and a very extensive email thread in
the archives.  Glad to be of assistance - John

[Rick Dicaire]

On Tue, May 4, 2010 at 7:07 AM, John A. Sullivan III
<jsullivan(a)opensourcedevel.com&gt; wrote:
> > Why doesn't the group I'd added the user to show?
> >
>  I do not know if it is the same issue but I found I had to add the
>  posixgroup objectclass to the group; I had to add the memberuid 
As a followup, is this group issue something specific to 389, or ldap
in general?
I'm wondering if I should try another ldap server implementation.

Thanks

-- 
aRDy Music and Rick Dicaire present:
http://www.ardynet.com
http://www.ardynet.com:9000/ardymusic.ogg.m3u

[Rich Megginson]

Rick Dicaire wrote:
>  On Tue, May 4, 2010 at 7:07 AM, John A. Sullivan III
>  <jsullivan(a)opensourcedevel.com&gt; wrote:
>    
> >> Why doesn't the group I'd added the user to show?
> >>
> >>       
> > I do not know if it is the same issue but I found I had to add the
> > posixgroup objectclass to the group; I had to add the memberuid
> >     
>
>  As a followup, is this group issue something specific to 389, or ldap
>  in general?
>     
ldap in general
>  I'm wondering if I should try another ldap server
> implementation.
>     
you'll probably have to do the same or similar with another ldap server
>  Thanks
>
>