OpenLDAP – Enabling memberOf on Ubuntu 20.04

openldapubuntu-20.04

I've spent the last few days following multiple how to guides to create an LDAP server with memberOf enabled, on a fully updated clean install of Ubuntu Server 20.04.2, purging between each attempt.

Most recently I've tried using the Perl Module slapdconf (https://github.com/Evolveum/slapdconf).
The commands I ran were:

sudo apt install slapd ldap-utils
sudo apt install libnet-ldap-perl libauthen-sasl-perl perl-doc
git clone https://github.com/Evolveum/slapdconf.git
cd slapdconf/
sudo cp ldap* /usr/local/bin/
sudo cp schema2ldif /usr/local/bin/
sudo cp slapd* /usr/local/bin/
sudo dpkg-reconfigure slapd
# creating mydomain.tld
sudo slapdconf list-suffixes
# confirmed mydomain.tld is the only suffix
sudo slapdconf add-module memberof
# No errors
sudo slapdconf add-overlay dc=mydomain,dc=tld memberof
# No errors
sudo slapdconf add-module refint
# No errors
sudo slapdconf add-overlay dc=mydomain,dc=tld refint olcRefintConfig 'olcRefintAttribute:memberof member manager owner'
# No errors

After doing this I configured phpldapadmin, logged in and created cn=test,ou=groups,dc=mydomain,dc=tld and cn=Fred Bloggs,ou=people,dc=mydomain,dc=tld and added Fred Bloggs to the test group. however, running ldapsearch -x -LLL -H ldap:/// -b "cn=Fred Bloggs,ou=people,dc=mydomain,dc=tld" dn memberof only returns the dn and no memberOf property.

I've tired doing this manually following different varients of https://www.adimian.com/blog/how-to-enable-memberof-using-openldap/ too.

Please can someone let me know what I'm missing, or suggest an alternative LDAP server that has working memberOf overlay.

I've seen a few questions on different forums around getting memberOf to work, but none of the accepted solutions I've seen have worked for me, and they are all for much older versions of Ubuntu.

Thanks
Joe

Best Answer

It turns out I was creating the wrong type of group, and that is why memberOf was never created.

In PHPLDAPAdmin the create child type list offers posixGroup, but this is not the right option.

Anyone finding this later, you need to select default, and then groupOfNames from the big list.