NAME¶

slapo-nestgroup - Nested Group overlay to slapd

SYNOPSIS¶

/etc/openldap/slapd.conf

DESCRIPTION¶

The nestgroup overlay to slapd(8) supports evaluation of nested groups in Search operations. Support consists of four possible features: inclusion of parent groups when searching with (member=) filters, inclusion of child groups when searching with (memberOf=) filters, expansion of child groups when returning member attributes, and expansion of parent groups when returning memberOf attributes. Each of these features may be enabled independently. By default, no features are enabled, so this overlay does nothing unless explicitly enabled.

CONFIGURATION¶

The config directives that are specific to the nestgroup overlay must be prefixed by nestgroup-, to avoid potential conflicts with directives specific to the underlying database or to other stacked overlays.

overlay nestgroup

This directive adds the nestgroup overlay to the current database; see slapd.conf(5) for details.

The following slapd.conf configuration options are defined for the nestgroup overlay.

nestgroup-member <member-ad>

The value <member-ad> is the name of the attribute that contains the names of the members in the group objects; it must be DN-valued. It defaults to member.

nestgroup-memberof <memberof-ad>

The value <memberof-ad> is the name of the attribute that contains the names of the groups an entry is member of; it must be DN-valued. It defaults to memberOf.

nestgroup-base <dn>

The value <dn> specifies a subtree that contains group entries in the DIT. This may be specified multiple times for multiple distinct subtrees. It has no default and the overlay does no processing unless it is explicitly configured.

nestgroup-flags {member-filter, memberof-filter, member-values, memberof-values}

This option specifies which features to enable in the overlay. By default, nothing is enabled and the overlay is a no-op.

The nestgroup overlay may be used with any backend that provides standard search functionality.

FILES¶

/etc/openldap/slapd.conf

default slapd configuration file

SEE ALSO¶

slapo-dynlist(5), slapo-memberof(5), slapd.conf(5), slapd-config(5), slapd(8). The slapo-nestgroup(5) overlay supports dynamic configuration via back-config.

ACKNOWLEDGEMENTS¶

This module was written in 2024 by Howard Chu of Symas Corporation.