Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[bitnami/openldap] memberOf overlay does not work #982

Closed
mohsensamiei opened this issue Jul 19, 2022 · 19 comments
Closed

[bitnami/openldap] memberOf overlay does not work #982

mohsensamiei opened this issue Jul 19, 2022 · 19 comments
Assignees
Labels
openldap solved stale 15 days without activity

Comments

@mohsensamiei
Copy link

mohsensamiei commented Jul 19, 2022

Name and Version

bitnami/openldap:2.6.3

What steps will reproduce the bug?

Hey
Hi have setup openldap with this docker-compose

version: "3.9"

volumes:
  openldap_data:

services:
  openldap:
    image: bitnami/openldap:2
    ports:
      - 1389:1389
      - 1636:1636
    environment:
      - LDAP_ROOT=dc=example,dc=com
      - LDAP_ADMIN_USERNAME=admin
      - LDAP_ADMIN_PASSWORD=adminpassword
    volumes:
      - openldap_data:/bitnami/openldap

So execute this:

dn: ou=groups,dc=example,dc=com
objectclass: organizationalUnit
ou: groups

dn: ou=users,dc= example,dc=com
objectclass: organizationalUnit
ou: users

dn: cn=user01,ou=users,dc= example,dc=com
cn: user01,
objectclass: inetOrgPerson
objectclass: top
sn: bar01
uid: user01

dn: cn=group01,ou=groups,dc= example,dc=com
cn: group01
member: cn= user01,ou=users,dc= example,dc=com
objectclass: groupOfNames
objectclass: top

dn: cn= group02,ou=groups,dc= example,dc=com
cn: group02
objectclass: groupOfUniqueNames
objectclass: top
uniquemember: cn= user01,ou=users,dc= example,dc=com

What is the expected behavior?

when i get user01, memberOf attribute does not set

dn: cn=user01,ou=users,dc= example,dc=com
cn: user01
createtimestamp: 20220719080619Z
creatorsname: cn=admin,dc=example,dc=com
entrycsn: 20220719080619.489607Z#000000#000#000000
entrydn: cn= user01,ou=users,dc= example,dc=com
entryuuid: 6a597960-9b85-103c-89c9-2986caa8c126
hassubordinates: FALSE
modifiersname: cn=admin,dc= example,dc=com
modifytimestamp: 20220719080619Z
objectclass: inetOrgPerson
objectclass: top
structuralobjectclass: inetOrgPerson
subschemasubentry: cn=Subschema
uid: user01

What do you see instead?

I want to see memberOf attribute also:

dn: cn=user01,ou=users,dc= example,dc=com
memberof: cn=group01,ou=groups,dc= example,dc=com
memberof: cn= group02,ou=groups,dc=example,dc=com
...

Additional information

Thanks for your help

@javsalgar
Copy link
Contributor

Hi,

Could you share the exact commands that trigger the issue? We would like to properly reproduce it on our side.

@mohsensamiei
Copy link
Author

mohsensamiei commented Jul 19, 2022

Sure, but I'm golang developer and source of commands is in go
docker-compose.yml

version: "3.9"

volumes:
  openldap_data:

services:
  openldap:
    image: bitnami/openldap
    ports:
      - 1389:1389
      - 1636:1636
    environment:
      - LDAP_ROOT=dc=example,dc=com
      - LDAP_ADMIN_USERNAME=admin
      - LDAP_ADMIN_PASSWORD=adminpassword
    volumes:
      - openldap_data:/bitnami/openldap

main.go

package main

import (
	"github.com/go-ldap/ldap/v3"
	"log"
	"strings"
)

func main() {
	conn, err := ldap.DialURL("ldap://localhost:1389")
	if err != nil {
		panic(err)
	}
	if err = conn.Bind("cn=admin,dc=example,dc=com", "adminpassword"); err != nil {
		panic(err)
	}
	defer conn.Close()

	if err = conn.Add(&ldap.AddRequest{
		DN: "ou=groups,dc=example,dc=com",
		Attributes: []ldap.Attribute{
			{
				Type: "objectClass",
				Vals: []string{"organizationalUnit"},
			},
		},
		Controls: nil,
	}); err != nil {
		panic(err)
	}

	if err = conn.Add(&ldap.AddRequest{
		DN: "cn=group01,ou=groups,dc=example,dc=com",
		Attributes: []ldap.Attribute{
			{
				Type: "objectClass",
				Vals: []string{"groupOfNames", "top"},
			},
			{
				Type: "member",
				Vals: []string{"cn=user01,ou=users,dc=example,dc=com"},
			},
		},
		Controls: nil,
	}); err != nil {
		panic(err)
	}

	if err = conn.Add(&ldap.AddRequest{
		DN: "cn=group02,ou=groups,dc=example,dc=com",
		Attributes: []ldap.Attribute{
			{
				Type: "objectClass",
				Vals: []string{"groupOfUniqueNames", "top"},
			},
			{
				Type: "uniqueMember",
				Vals: []string{"cn=user02,ou=users,dc=example,dc=com"},
			},
		},
		Controls: nil,
	}); err != nil {
		panic(err)
	}

	searchReq := ldap.NewSearchRequest("dc=example,dc=com",
		ldap.ScopeWholeSubtree,
		ldap.NeverDerefAliases,
		0,
		0,
		false,
		"(objectClass=inetOrgPerson)",
		[]string{"*", "+"},
		nil)
	result, err := conn.Search(searchReq)
	if err != nil {
		panic(err)
	}
	for _, entry := range result.Entries {
		for _, attribute := range entry.Attributes {
			if strings.ToLower(attribute.Name) == "memberof" {
				log.Print("Goal !!")
			}
		}
	}
}

run these commands:

docker compose up -d
go run .
docker compose down -v

Can this help you?

@mohsensamiei
Copy link
Author

is there any updates?

@javsalgar
Copy link
Contributor

Does the same issue happen when you use the OpenLDAP shell command equivalents?

@mohsensamiei
Copy link
Author

mohsensamiei commented Jul 21, 2022

OK
Run bitnami openldap with this docker-compose.yml

version: "3.9"

volumes:
  openldap_data:

services:
  openldap:
    container_name: openldap
    image: bitnami/openldap
    ports:
      - 1389:1389
      - 1636:1636
    environment:
      - LDAP_ROOT=dc=example,dc=com
      - LDAP_ADMIN_USERNAME=admin
      - LDAP_ADMIN_PASSWORD=adminpassword
    volumes:
      - openldap_data:/bitnami/openldap

So by default it's create an OU with this DN ou=users,dc=example,dc=com and create 2 users with these DN user01,ou=users,dc=example,dc=com, user02,ou=users,dc=example,dc=com
Then exec the container with docker exec -it openldap bash and create test ldif file with cat > test.ldif

dn: ou=groups,dc=example,dc=com
objectclass: organizationalUnit
ou: groups

dn: cn=group01,ou=groups,dc=example,dc=com
cn: group01
objectclass: groupOfNames
member: cn= user01,ou=users,dc=example,dc=com

dn: cn= group02,ou=groups,dc=example,dc=com
cn: group02
objectclass: groupOfUniqueNames
uniquemember: cn= user01,ou=users,dc=example,dc=com

and add test.ldif to ldap with ldapadd -H "ldapi:///" -D cn=admin,dc=example,dc=com -w adminpassword -f test.ldif, so see the result:

adding new entry "ou=groups,dc=example,dc=com"

adding new entry "cn=group01,ou=groups,dc=example,dc=com"

adding new entry "cn= group02,ou=groups,dc=example,dc=com"

and then search in ldap for user01 with ldapsearch -D cn=admin,dc=example,dc=com -w adminpassword -H "ldapi:///" -s base -b cn=user01,ou=users,dc=example,dc=com +, see the result:

# extended LDIF
#
# LDAPv3
# base <cn=user01,ou=users,dc=example,dc=com> with scope baseObject
# filter: (objectclass=*)
# requesting: + 
#

# user01, users, example.com
dn: cn=user01,ou=users,dc=example,dc=com
structuralObjectClass: inetOrgPerson
entryUUID: 91f113ee-9d55-103c-8b5c-69baf3ded424
creatorsName: cn=admin,dc=example,dc=com
createTimestamp: 20220721152852Z
entryCSN: 20220721152852.391580Z#000000#000#000000
modifiersName: cn=admin,dc=example,dc=com
modifyTimestamp: 20220721152852Z
entryDN: cn=user01,ou=users,dc=example,dc=com
subschemaSubentry: cn=Subschema
hasSubordinates: FALSE

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1

So there is not memberOf attribute in entry :)

@mohsensamiei
Copy link
Author

Do you think this problem can be fixed?
@javsalgar

@carrodher
Copy link
Member

We are going to transfer this issue to bitnami/containers

In order to unify the approaches followed in Bitnami containers and Bitnami charts, we are moving some issues in bitnami/bitnami-docker-<container> repositories to bitnami/containers.

Please follow bitnami/containers to keep you updated about the latest bitnami images.

More information here: https://blog.bitnami.com/2022/07/new-source-of-truth-bitnami-containers.html

@carrodher carrodher transferred this issue from another repository Jul 28, 2022
@bitnami-bot bitnami-bot added the triage Triage is needed label Jul 28, 2022
@carrodher carrodher assigned javsalgar and unassigned fmulero Jul 28, 2022
@bitnami-bot bitnami-bot added in-progress and removed triage Triage is needed labels Jul 28, 2022
@carrodher carrodher assigned javsalgar and unassigned carrodher Jul 28, 2022
@javsalgar javsalgar assigned gongomgra and unassigned javsalgar Aug 1, 2022
@gongomgra
Copy link
Contributor

Hi @mohsensamiei,

I reviewed our compilation process and I found out we are not setting the --enable-memberof flag in the compilation process of OpenLDAP, which I understand can cause this issue. I will open a new task for our engineering team to update the compilation process and release a new revision of the image. Unfortunately, we can't provide you with an estimation on when this will be updated, but our team will post a new message here once it is finished.

@gongomgra gongomgra changed the title memberOf overlay does not work [openldap] memberOf overlay does not work Aug 5, 2022
@bitnami-bot bitnami-bot added the on-hold Issues or Pull Requests with this label will never be considered stale label Aug 5, 2022
@zcahana
Copy link
Contributor

zcahana commented Aug 18, 2022

I've just came across this issue myself as well.
As an interim workaround until the memberOf support is compiled into the image, is there some way to configure the image to enable the memberOf overlay?

@github-actions github-actions bot added the triage Triage is needed label Jan 23, 2023
@Dzordzu
Copy link

Dzordzu commented Feb 6, 2023

For onlookers:

If you want to use it with groupOfNames, go on with @fmulero config

In case of groupOfUnqiueNames use this (modified and working version of this answer)

dn: cn=module,cn=config
cn: module
objectClass: olcModuleList
olcModulePath: /opt/bitnami/openldap/lib/openldap
olcModuleLoad: memberof.so
olcModuleLoad: refint.so

dn: olcOverlay=memberof,olcDatabase={2}mdb,cn=config
objectClass: olcMemberOf
objectClass: olcOverlayConfig
olcOverlay: memberof
olcMemberOfRefInt: TRUE
olcMemberOfGroupOC: groupOfUniqueNames
olcMemberOfMemberAD: uniqueMember
olcMemberOfMemberOfAD: memberOf

dn: olcOverlay=refint,olcDatabase={2}mdb,cn=config
objectClass: olcConfig
objectClass: olcOverlayConfig
objectClass: olcRefintConfig
objectClass: top
olcOverlay: refint
olcRefintAttribute: memberof uniqueMember manager owner

@github-actions github-actions bot removed the solved label Feb 6, 2023
@javsalgar javsalgar changed the title [openldap] memberOf overlay does not work [bitnami/openldap] memberOf overlay does not work Feb 7, 2023
@github-actions github-actions bot added the solved label Feb 7, 2023
@github-actions github-actions bot removed the solved label Mar 23, 2023
@wotsyula
Copy link

I'm going to post my workaround in case anyone needs it:

00-modules.ldif

dn: cn=module{0},cn=config
changetype: modify
add: olcModuleLoad
olcModuleLoad: memberof
olcModuleLoad: refint

01-memberof.ldif

dn: olcOverlay=memberof,olcDatabase={2}mdb,cn=config
changetype: add
objectClass: olcConfig
objectClass: olcMemberOf
objectClass: olcOverlayConfig
objectClass: top
olcOverlay: memberof
olcMemberOfDangling: ignore
olcMemberOfRefInt: TRUE
olcMemberOfGroupOC: groupOfNames
olcMemberOfMemberAD: member
olcMemberOfMemberOfAD: memberOf

02-refint.ldif

dn: olcOverlay=refint,olcDatabase={2}mdb,cn=config
changetype: add
objectClass: olcConfig
objectClass: olcOverlayConfig
objectClass: olcRefintConfig
objectClass: top
olcOverlay: refint
olcRefintAttribute: memberof member manager owner

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
openldap solved stale 15 days without activity
Projects
None yet
Development

No branches or pull requests