The config validation code in the memberOf plug-in currently requires that the grouping attribute be defined to use the Distinguished Name syntax. The uniqueMember attribute is still a common method of grouping users, but this attribute is defined to use the Name and Optional UID syntax. This syntax contains a DN plus an optional hex-valued UID that can be appended to the end. We should allow attribute defined to use the Name and Optional UID syntax to be used as memberOf grouping attributes. We will not support one actually using the optional UID portion in the value, but this is extremely rare in practice.
Created attachment 462466 [details] Patch
Pushed to master. Thanks to Rich for his review! Counting objects: 15, done. Delta compression using up to 2 threads. Compressing objects: 100% (8/8), done. Writing objects: 100% (8/8), 1.08 KiB, done. Total 8 (delta 5), reused 0 (delta 0) To ssh://git.fedorahosted.org/git/389/ds.git 36dbaf1..b989f1d master -> master
Documentation Impact : I think this notice ("one should be aware that memberOf will not work if the optional UID part present in an attribute with <Name and Optional UID > syntax. The usage of the optional UID portion in the value is extremely rare in practice.") should be added to the documentation on memberOf plug-in of the future RedHat release.
Can you please add steps to verify? An example of Name and Optional UID syntax used as memberOf grouping attributes? Thanks
(In reply to comment #5) > Can you please add steps to verify? An example of Name and Optional UID syntax > used as memberOf grouping attributes? Thanks Configure the memberOf plug-in and set "memberofgroupattr" to "uniqueMember" in the configuration entry. This config entry should not be rejected as an error.
Not rejected --- dn: cn=MemberOf Plugin,cn=plugins,cn=config objectClass: top objectClass: nsSlapdPlugin objectClass: extensibleObject cn: MemberOf Plugin nsslapd-pluginPath: libmemberof-plugin nsslapd-pluginInitfunc: memberof_postop_init nsslapd-pluginType: postoperation nsslapd-pluginEnabled: on nsslapd-plugin-depends-on-type: database memberofgroupattr: uniqueMember memberofattr: memberOf nsslapd-pluginId: memberof nsslapd-pluginVersion: 1.2.8.2 nsslapd-pluginVendor: 389 Project nsslapd-pluginDescription: memberof plugin Hence VERIFIED.