[Bug] LDAP rfc2307bis doesn't have memberOf plugin enabled by default

[andreboscatto]

While testing memberOf LDAP filter, I discovered (thanks to @danlavu ) that memberOf plugin was disabled.

After enabling it and restarting the LDAP service it worked! I performed some tests and it didn't affect rfc2307bis = false tests (as far as I see).

Here is the tests that I did:

u1 = provider.user("user1").add()
u2 = provider.user("user2").add()
u3 = provider.user("user3").add()

provider.group("group1", rfc2307bis=True).add().add_member(u1)
provider.group("group2").add().add_member(u2)
provider.group("group3").add().add_members([u1, u2, u3])

And here is the LDAP structure output for groups:

dn: cn=group1,ou=groups,dc=ldap,dc=test
objectClass: groupOfNames
objectClass: posixGroup
cn: group1
member: cn=user1,ou=users,dc=ldap,dc=test

dn: cn=group2,ou=groups,dc=ldap,dc=test
objectClass: posixGroup
gidNumber: 33002
cn: group2
memberUid: user2

dn: cn=group3,ou=groups,dc=ldap,dc=test
objectClass: posixGroup
gidNumber: 33003
cn: group3
memberUid: user1
memberUid: user2
memberUid: user3

And here is the LDAP structure output for users:

dn: cn=user1,ou=users,dc=ldap,dc=test
objectClass: nsMemberOf
objectClass: posixAccount
objectClass: top
cn: user1
gidNumber: 23001
homeDirectory: /home/user1
uid: user1
uidNumber: 23001
memberOf: cn=group1,ou=groups,dc=ldap,dc=test

dn: cn=user2,ou=users,dc=ldap,dc=test
objectClass: posixAccount
objectClass: top
cn: user2
gidNumber: 23002
homeDirectory: /home/user2
uid: user2
uidNumber: 23002
userPassword:: e1NIQTI1Nn1MdEJuWm5sZFdLVHlMVkVhWnk4Z3ByQ1cwLzViVnE4NmRFWjRxY
 U5XL1lJPQ==


dn: cn=user3,ou=users,dc=ldap,dc=test
objectClass: posixAccount
objectClass: top
cn: user3
gidNumber: 23003
homeDirectory: /home/user3
uid: user3
uidNumber: 23003
userPassword:: e1NIQTI1Nn1MdEJuWm5sZFdLVHlMVkVhWnk4Z3ByQ1cwLzViVnE4NmRFWjRxY
 U5XL1lJPQ==

Based on that, only the groups with rfc2307bis = true have the memberOf relationship.

I believe it is safe to enable the plugin by default - of course I am not an expert in the field, so I count on others to tell me if I am not seeing something.

[alexey-tikhonov]

I believe it is safe to enable the plugin by default

Why is this needed?

[danlavu]

Why is this needed?

Currently, any RFC2307bis test scenarios are invalid. While the group has attributes and values that point to the user. the user is missing any attribute that links them to the group, i.e. memberOf

[alexey-tikhonov]

Why is this needed?

Currently, any RFC2307bis test scenarios are invalid. While the group has attributes and values that point to the user. the user is missing any attribute that links them to the group, i.e. memberOf

I was unsure if SSSD LDAP provider actually relies on this.

[sumit-bose]

Why is this needed?

Currently, any RFC2307bis test scenarios are invalid. While the group has attributes and values that point to the user. the user is missing any attribute that links them to the group, i.e. memberOf

Hi,

in which sense are they invalid? If I see it correctly for user/group lookup with RFC2307bis SSSD read the attribute for completeness but does not depend on it since many LDAP servers might not generate it automatically since it is not part of RFC2307bis.

bye,
Sumit

[danlavu]

I was unsure if SSSD LDAP provider actually relies on this.

It doesn't; it's optional. Enabling it requires restarting 389ds, and it doesn't negatively impact anything else, so we'd like this to be the default behavior. The plugin primarily just adds the memberOF attribute when a memberUID is added to the group.

As it stands right now, setting rfc2307bis in the framework only does the group attribute memberUID.

[alexey-tikhonov]

it doesn't negatively impact anything else

You will see a significant performance impact while adding massive number of objects.

[andreboscatto]

it doesn't negatively impact anything else

You will see a significant performance impact while adding massive number of objects.

Even if the schema is not used? I mean, just having the plugin enabled makes such a difference?

[andreboscatto]

Another solution would be to:

1. Identify if the schema is being set when we add a group
2. Enable the plugin
3. Restard LDAP server
4. Perform the tests
5. Disable the plugin
6. Restart LDAP server

Now we need to decide which approach to follow.

[alexey-tikhonov]

I'm still not sure why is this needed.