OpenDLAP group-ldap-mapper with groupOfURLs

Configuring the server
,
1

I’m playing with dynamic groups in LDAP (Group Object Classes: groupOfURLs; Membership LDAP Attribute: member). We are using keycloak 12.0.2 docker image.

Keycloak is able to fetch the group but not the members. Debugging the LDAP queries via tcpdump (after disabling TLS) helped to understand the reason:

The LDAP Client in keycloak is setting LDAP ManageDSA IT Control RFC 3296: References

man ldapsearch
-M[M] Enable manage DSA IT control. -MM makes control critical.

ldapsearch w/o this flag is working fine:

# dyntest, dyngroups, groups, example.com
dn: cn=dyntest,ou=dyngroups,ou=groups,dc=example,dc=com
cn: dyntest
objectClass: groupOfURLs
objectClass: top
entryUUID: 07ee873e-04aa-103b-9e72-952f9e4d90e3
memberURL: ldap:///ou=people,dc=example,dc=com?uid?sub?(uid=hans.dampf)
memberURL: ldap:///ou=foo,ou=people,dc=example,dc=com?uid?one?(objectClass=person)
member: uid=hans.dampf,ou=dev-berlin,ou=people,dc=example,dc=com
member: uid=xxx.yyy,ou=foo,ou=people,dc=example,dc=com
member: uid=xxx.ccc,ou=foo,ou=people,dc=example,dc=com

With this flag (ldapsearch -M) enabled the memberURLs are not resolved to member attributes on the server:

requesting: All userApplication attributes
# extended LDIF
#
# LDAPv3
# base <ou=dyngroups,ou=groups,dc=example,dc=com> with scope subtree
# filter: (&(cn=dyntest)(objectClass=groupOfURLs))
# requesting: ALL
# with manageDSAit control
#

# dyntest, dyngroups, groups, example.com
dn: cn=dyntest,ou=dyngroups,ou=groups,dc=example,dc=com
cn: dyntest
objectClass: groupOfURLs
objectClass: top
memberURL: ldap:///ou=people,dc=example,dc=com?uid?sub?(uid=hans.dampf)
memberURL: ldap:///ou=foo,ou=people,dc=example,dc=com?uid?one?(objectCla
 ss=person)

Is it possible to disable this flag somehow or why it is used?

2

No ideas? Maybe this topic is too special. Already tried to create a ldap federation provider as “Red Hat Directory Server” but this is also not working.

3

Did you ever end up resolving this issue? I’m dealing with the same problem, and my LDAP structure doesn’t really allow much by way of reorganizing to work around this problem…

4

Hey @Mikrz

This post is kind old , there using version 12 which like 8 version behind the current one now. If you have issue/s perhaps create a post. Just an idea

5

I did not find a solution.