☰

OpenLDAP：检索组成员

tag-icon • tag-icon openldap
OpenLDAP：检索组成员

我在 openldap 中启用了 memberof 模块。添加了两个组及其下的一些成员。(groupOfNames)

当我使用过滤器打印特定组的成员时(&(objectClass=groupOfNames)(cn=bowlers))，它仅打印该组的第一个成员，尽管该组有多个成员。

如何列出一个群组的所有成员？

# extended LDIF
#
# LDAPv3
# base <dc=example,dc=com> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#

# example.com
dn: dc=example,dc=com
objectClass: top
objectClass: dcObject
objectClass: organization
o: Sierraware
dc: example

# admin, example.com
dn: cn=admin,dc=example,dc=com
objectClass: simpleSecurityObject
objectClass: organizationalRole
cn: admin
description: LDAP administrator
userPassword:: e1NTSEF9NFZXYit2MlVBS2xRVUdBOWVjK2IrSHBac3VpYnV6ZlM=

# People, example.com
dn: ou=People,dc=example,dc=com
objectClass: organizationalUnit
objectClass: top
ou: People

# Groups, example.com
dn: ou=Groups,dc=example,dc=com
objectClass: organizationalUnit
objectClass: top
ou: Groups

# adam, People, example.com
dn: uid=adam,ou=People,dc=example,dc=com
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
uid: adam
sn: hanks
givenName: adam
cn: Adam hanks
displayName: Adam hanks
uidNumber: 10000
gidNumber: 5000
userPassword:: YWRhbWxkYXA=
gecos: Adam hanks
loginShell: /bin/bash
homeDirectory: /home/adam

# john, People, example.com
dn: uid=john,ou=People,dc=example,dc=com
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
uid: john
sn: doe
givenName:: am9obiA=
cn: John Doe
displayName: John Doe
uidNumber: 10000
gidNumber: 5000
userPassword:: am9obmxkYXA=
gecos: John Doe
loginShell: /bin/bash
homeDirectory: /home/john


# wahab, People, example.com
dn: uid=wahab,ou=People,dc=example,dc=com
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
uid: wahab
sn: riyaz
givenName:: d2FoYWIg
cn: Wahab Riaz
displayName: Wahab Riaz
uidNumber: 10008
gidNumber: 5008
userPassword:: d2FoYWJsZGFw
gecos:: V2FoYWIgUmlheiA=
loginShell: /bin/bash
homeDirectory: /home/wahab

# sachin, People, example.com
dn: uid=sachin,ou=People,dc=example,dc=com
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
uid: sachin
sn: ramesh
givenName:: c2FjaGluIA==
cn: Sachin Ramesh
displayName: Sachin Ramesh
uidNumber: 10009
gidNumber: 5009
userPassword:: c2FjaGlubGRhcA==
gecos:: U2FjaGluIFJhbWVzaCA=
loginShell: /bin/bash
homeDirectory: /home/sachin

# bowlers, People, example.com
dn: cn=bowlers,ou=People,dc=example,dc=com
objectClass: groupOfNames
cn: bowlers
description: IT security group
member: cn=wahab,ou=People,dc=example,dc=com
member: cn=sachin,ou=People,dc=example,dc=com

答案1

例如如果你有这样的组：

dn: cn=people-admins,ou=groups,dc=example,dc=com
objectClass: groupOfUniqueNames
cn: admins of people group
cn: people-admins
uniqueMember: uid=test1,ou=people,dc=example,dc=com
uniqueMember: uid=test2,ou=people,dc=example,dc=com

您可以使用以下命令打印其所有成员：

ldapsearch -x -LLL -H ldap://127.0.0.1:3000/  -b dc=example,dc=com -s sub '(&(objectClass=inetOrgPerson)(memberof=cn=people-admins,ou=groups,dc=example,dc=com))' -D "cn=admin,dc=example,dc=com" -w admin uid
dn: uid=test1,ou=people,dc=example,dc=com
uid: evgeniy

dn: uid=test2,ou=people,dc=example,dc=com
uid: test2

更新

就我而言，ldapsearch 无法处理您的测试数据，因为我的配置如下：

# Load memberof module
dn: cn=module{0},cn=config
changetype: modify
add: olcModuleLoad
olcModuleLoad: memberof

# Backend memberOf overlay
dn: olcOverlay={0}memberof,olcDatabase={1}hdb,cn=config
changetype: add
objectClass: olcOverlayConfig
objectClass: olcMemberOf
olcOverlay: {0}memberof
olcMemberOfDangling: ignore
olcMemberOfRefInt: TRUE
olcMemberOfGroupOC: groupOfUniqueNames
olcMemberOfMemberAD: uniqueMember
olcMemberOfMemberOfAD: memberOf

所以我将您的测试数据更改为：

dn: cn=bowlers,ou=People,dc=example,dc=com
objectClass: groupOfUniqueNames
cn: bowlers
description: IT security group
uniqueMember: uid=wahab,ou=People,dc=example,dc=com
uniqueMember: uid=sachin,ou=People,dc=example,dc=com

进而：

ldapsearch -x -LLL -H ldap://127.0.0.1:3000/  -b dc=example,dc=com -s sub '(memberof=cn=bowlers,ou=People,dc=example,dc=com)' -D "cn=admin,dc=example,dc=com" -w admin uid
dn: uid=wahab,ou=People,dc=example,dc=com
uid: wahab

dn: uid=sachin,ou=People,dc=example,dc=com
uid: sachin

因此您必须配置memberof覆盖层以使用groupOfNames或将其类更改为groupOfUniqueNames

相关内容