When memberOf nesting was added, it was added for the ipa use case. However, trying to use this in pure ds results in
ldap_modify: Object class violation (65) Error at: cn=some_entitlement,dc=example,dc=com
This is because given a set of groups and users like:
dn: uid=user,dc=example,dc=com objectClass: top objectClass: account objectClass: inetUser uid: user memberOf: cn=some_company,dc=example,dc=com dn: cn=some_company,dc=example,dc=com objectClass: groupOfNames objectClass: top cn: some_company member: uid=user,dc=example,dc=com dn: cn=some_entitlement,dc=example,dc=com objectClass: groupOfNames objectClass: top cn: some_entitlement
Attempting to add "member" to some_entitlement of cn=some_company, memberOf is not valid on groupOfNames. The only types in the base schema that allow this are inetUser and inetAdmin: Neither of which really match here.
In order to allow nested groups in a straight 389-ds install, we need something which allows MemberOf on those objects. I think we should add a schema objectClass such as:
objectClasses: ( OID NAME 'nsNestedGroup' DESC 'Allow group nesting in ns-slapd' SUP top AUXILIARY MAY ( memberOf ) X-ORIGIN '389 Directory Server Project' )
Somehow be related to http://directory.fedoraproject.org/docs/389ds/design/memberof-auto-add-oc.html
Metadata Update from @tbordaz: - Issue set to the milestone: 1.3.6 backlog
Metadata Update from @firstyear: - Issue assigned to firstyear
Sure, we could use it like that. I guess if we rename it to say nsMemberOf, then it could apply to users and groups automatically.
Metadata Update from @firstyear: - Issue close_status updated to: None
<img alt="0001-Ticket-48985-Add-schema-for-nested-groups-to-work-ou.patch" src="/389-ds-base/issue/raw/files/0fb39267ed2fb03ead468e41c3c81a0bc862fe7414b4dfe4368bff9f166751f3-0001-Ticket-48985-Add-schema-for-nested-groups-to-work-ou.patch" />
Assigned from rhanana, will commit once this is acked.
Metadata Update from @firstyear: - Custom field reviewstatus adjusted to review
Indentation issue again, otherwise ack
Metadata Update from @mreynolds: - Custom field reviewstatus adjusted to ack (was: review)
commit 0c1d8f16c4f6c45dd83b3f2ecd4221b40ed8ada3 To ssh://git@pagure.io/389-ds-base.git 0804c43..620d037 master -> master
Metadata Update from @firstyear: - Issue close_status updated to: fixed - Issue status updated to: Closed (was: Open)
389-ds-base is moving from Pagure to Github. This means that new issues and pull requests will be accepted only in 389-ds-base's github repository.
This issue has been cloned to Github and is available here: - https://github.com/389ds/389-ds-base/issues/2044
If you want to receive further updates on the issue, please navigate to the github issue and click on subscribe button.
subscribe
Thank you for understanding. We apologize for all inconvenience.
Metadata Update from @spichugi: - Issue close_status updated to: wontfix (was: fixed)
Login to comment on this ticket.