Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Can't find members of a group, if prepopulation is used #21

Open
igorbljahhin opened this issue Mar 16, 2017 · 11 comments
Open

Can't find members of a group, if prepopulation is used #21

igorbljahhin opened this issue Mar 16, 2017 · 11 comments

Comments

@igorbljahhin
Copy link

Hi!

I can't get the search of "memberOf" working. My setup using docker-compose is following:

version: "2"

services:
openldap:
image: dinkel/openldap:latest
container_name: openldap
environment:
SLAPD_ORGANIZATION: "a company"
SLAPD_DOMAIN: "rosinad.com"
SLAPD_PASSWORD: "admin"
SLAPD_CONFIG_PASSWORD: "config"
SLAPD_ADDITIONAL_MODULES: "memberof"
volumes:
- data_openldap:/etc/ldap
- data_openldap_config:/var/lib/ldap
- ./docker/openldap:/etc/ldap.dist/prepopulate
ports:
- "389:389"

I have three files in ./docker/openldap: 01-base.ldif, 02-users.ldif and 03-groups.ldif with following content (only important parts are shown):

01-base.ldif:
dn: ou=people,dc=rosinad,dc=com
objectclass: organizationalUnit
ou: People

dn: ou=groups,dc=rosinad,dc=com
objectclass: organizationalUnit
ou: Groups

02-users.ldif:
dn: uid=seagate_user,ou=people,dc=rosinad,dc=com
cn: Seagate User
sn: User
gidnumber: 10000
homedirectory: /home/users/seagate_user
objectClass: posixAccount
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
loginShell: /bin/bash
uid: seagate_user
uidnumber: 1001
userpassword: seagate_user

03-groups.ldif:
dn: cn=GPWUSERS,ou=groups,dc=rosinad,dc=com
cn: GPWUSERS
objectClass: groupofnames
member: uid=seagate_user,ou=people,dc=rosinad,dc=com

and search by the query "(&(objectClass=person)(memberOf=cn=GPWUSERS,ou=groups,dc=rosinad,dc=com))" is returning nothing.

But if I manually add the group with member after OpenLDAP is started, then the search is returning that one result.

My guess is that memberOf module is enabled after my files are prepopulated, but if I look at the source code of entrypoint script, then I see that prepopulation is performed in the end of the script.

Could you give me some hints that could be wrong with my approach?

thanks!

@igorbljahhin igorbljahhin changed the title Can't find "memberOf", if prepopulation is used Can't find members of a group, if prepopulation is used Mar 16, 2017
@xgodon
Copy link

xgodon commented Apr 28, 2017

i think the easiest solution would be to add your ldif files after the service start, as it seems to make memeberof effective.
Or you can build your own image and do somegarage stuff like launching a script in the background that wait 10seconds and then populate the DIT (after the 10 sec, the ldap will be started).

@duketwo
Copy link

duketwo commented Jun 22, 2017

Refactor the entrypoint.sh script?

Edit: Doesn't seem to work, currently struggling with the same problem. Will post an update if I found a solution.

@duketwo
Copy link

duketwo commented Jun 22, 2017

I get these in the logs: 594bf5ec <= bdb_equality_candidates: (memberOf) not indexed

@duketwo
Copy link

duketwo commented Jun 22, 2017

slapadd doesn't work with overlays, like memberOf. So the only workaround I'm aware of would be adding the groups with ldapadd while slapd is running.

@duketwo
Copy link

duketwo commented Jun 22, 2017

I'll add supervisord and add a script which checks if slapd is already running and then injecting the prepopulated data once.

@duketwo
Copy link

duketwo commented Jun 22, 2017

It's working fine when doing the said above. The supervisord script I've written therefore:

https://pastebin.c4s.de/asajafevul.bash

@srollinet
Copy link

Hi @duketwo

I have the same problem, but I don't fully understand what to do to make your solution work.
Could you post a full procedure or a working fork?

Thanks a lot!

@xgodon
Copy link

xgodon commented Aug 24, 2017

i assume you have to delete the prepopulate part of the original entrypoint.sh (the

if [[ "$first_run" == "true" ]]; then
if [[ -d "/etc/ldap/prepopulate" ]]; then
for file in ls /etc/ldap/prepopulate/*.ldif; do
slapadd -F /etc/ldap/slapd.d -l "$file"
done
fi
fi

block)
you also have to run his script from the entrypoint.sh.

@olegbakhirev
Copy link

olegbakhirev commented Oct 25, 2018

@xgodon Unfortunatelly script is gone :( And not clear what was there. Does that require adding some libraries to the image?
@duketwo could you please repost it?

@duketwo
Copy link

duketwo commented Feb 20, 2019

@blizzz
Copy link

blizzz commented Mar 1, 2019

What is possible to do in the entrypoint file is to:

  • enable job control by set -m
  • start slapd and sent it to background "$@" &
  • sleep for 2 seconds…
  • instead of slapadd use ldapadd to import prepopulation files
    • requires ldap-utils to be installed within the dockerfile
  • bring slapd back to foreground fg

It's somewhat ugly though… or @dinkel do you think this would be tolerable to fix the issue?

ollitanska added a commit to Jedisoft/docker-openldap that referenced this issue Dec 13, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

6 participants