NethServer 8 + OpenLDAP

[fabiorb]

Help!

Hello everyone! I’m using NethServer 8 as an AD administrator for a domain (nettreck.local). AD authentication OK!, User search OK! However, when searching for groups I can’t list the group name. I can display all groups using: (&(objectcategory=group)) or (&(objectclass=group)) But not only the groups of Openfire users (g_u_openfire). Has anyone used this filter? In Microsoft AD everything was ok. But in Nethserver I couldn’t.

[guus]

Hi Fabio!

I’ve never used NethServer, but can you try to combine filters, like this: (&(objectclass=group)(cn=g_u_openfire)) ? I’m not sure which the appropriate identifiers are.

[speedy]

This might help you out

How to Setup Authentication Groups with LDAP/AD

In this example I’ll be using the following: AD domain = AD-DOMAIN.local access group = Openfire Access Group roster groups = _IM Group1, _IM Group2 (*note - I’ll be using _IM as part of a wildcard search, so all my groups start with _IM for that reason) First create your security groups: Create a Domain Local Security Group. In our example call it Openfire Access Group. In this example, I’ve placed the group in the user container. Create regular security groups (usually Global). In t…

[fabiorb]

@guus

(&(objectclass=group)(cn=g_u_openfire))

Hello, when I use (&(objectclass=group)(cn=g_u_openfire)) openfire only returns:
Group g_u_openfire - 36 members.

It does not return the user’s main group. It should return, like in AD…
Support - 12 Members
Sales - 33 members… for example.

[fabiorb]

Ok! This example is exactly what I have in AD and it’s working ok! However, I’m changing my AD admin to NethServer, and in this new scenario it’s not working. Users, Ok! Groups, no!

[speedy]

OpenLDAP is not a direct replacement for AD. Some of what I reference in the link is AD specific. Having said that, looks like OpenLDAP may not use objectclass=group. From my brief search, it looks like its groupOfNames or groupOfUniqueNames . I’m not an opeldap user, so I’m not 100% on this.

[fabiorb]

Hello, I did it! I created groups like ge_support, ge_sales… etc and set the group filter to LDAP using: (objectClass=group)(|(cn=ge_*)) - Posix = NO.

In the Groups configuration: Contact List (Roster) Sharing. I shared the ge_* groups among themselves, changing the display name: SALES, SUPPORT, etc.

Note: User Filter: (&(objectCategory=person)(objectClass=user)(memberOf=cn=ge_*))

All OK!

[speedy]

Glad you got it worked out and an appreciate you coming back and sharing your solution!