starred/lldap-lldap

Fork 0

mirror of https://github.com/lldap/lldap.git synced 2026-04-25 08:15:52 +03:00

[GH-ISSUE #468] When query user `memberof` attribute maybe wrong group dn is returned #177

New issue

Closed

opened 2026-02-27 08:15:41 +03:00 by kerem · 6 comments

kerem commented

2026-02-27 08:15:41 +03:00

Owner

Originally created by @zozzz on GitHub (Mar 3, 2023).
Original GitHub issue: https://github.com/lldap/lldap/issues/468

In this line the group common name returned as uid, but the documentation says the group name is cn=family,ou=groups,dc=example,dc=com. The memberOf queries is working like this naming convention.

Originally created by @zozzz on GitHub (Mar 3, 2023). Original GitHub issue: https://github.com/lldap/lldap/issues/468 In this [line](https://github.com/nitnelave/lldap/blob/2593606f1638c2708a9c7db08b0190391ad125c2/server/src/domain/ldap/user.rs#L49) the group common name returned as uid, but the documentation says the group name is `cn=family,ou=groups,dc=example,dc=com`. The memberOf queries is working like this naming convention.

kerem

2026-02-27 08:15:41 +03:00

closed this issue
added the
bug

good first issue

backend

ldap
labels

kerem commented

2026-02-27 08:15:42 +03:00

Author

Owner

@nitnelave commented on GitHub (Mar 4, 2023):

Both are valid. Technically, uid is probably more future proof, but it doesn't really matter.

@nitnelave commented on GitHub (Mar 4, 2023): Both are valid. Technically, uid is probably more future proof, but it doesn't really matter.

kerem commented

2026-02-27 08:15:42 +03:00

Author

Owner

@zozzz commented on GitHub (Mar 4, 2023):

Can you rename it to cn? I want to use with OPNSense, and excepting cn instead of uid. I think this is more standard in group names. Maybe this change breaks other apps.

@zozzz commented on GitHub (Mar 4, 2023): Can you rename it to cn? I want to use with OPNSense, and excepting cn instead of uid. I think this is more standard in group names. Maybe this change breaks other apps.

kerem commented

2026-02-27 08:15:42 +03:00

Author

Owner

@martadinata666 commented on GitHub (Mar 4, 2023):

you can override User naming attribute to uid, if that is what you mean by accepting cn

@martadinata666 commented on GitHub (Mar 4, 2023): you can override `User naming attribute` to `uid`, if that is what you mean by accepting `cn`

kerem commented

2026-02-27 08:15:42 +03:00

Author

Owner

@nitnelave commented on GitHub (Mar 4, 2023):

That would more be a request for opnsense, to add support for uid. It's
perfectly standard.

On Sat, 4 Mar 2023, 10:22 Vetési Zoltán, @.***> wrote:

Can you rename it to cn? I want to use with OPNSense, and excepting cn
instead of uid. I think this is more standard in group names. Maybe this
change breaks other apps.

—
Reply to this email directly, view it on GitHub
https://github.com/nitnelave/lldap/issues/468#issuecomment-1454675286,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AAGCPWNFX7XERZBOZGSLDULW2MCXBANCNFSM6AAAAAAVPFK3RI
.
You are receiving this because you commented.Message ID:
@.***>

@nitnelave commented on GitHub (Mar 4, 2023): That would more be a request for opnsense, to add support for uid. It's perfectly standard. On Sat, 4 Mar 2023, 10:22 Vetési Zoltán, ***@***.***> wrote: > Can you rename it to cn? I want to use with OPNSense, and excepting cn > instead of uid. I think this is more standard in group names. Maybe this > change breaks other apps. > > — > Reply to this email directly, view it on GitHub > <https://github.com/nitnelave/lldap/issues/468#issuecomment-1454675286>, > or unsubscribe > <https://github.com/notifications/unsubscribe-auth/AAGCPWNFX7XERZBOZGSLDULW2MCXBANCNFSM6AAAAAAVPFK3RI> > . > You are receiving this because you commented.Message ID: > ***@***.***> >

kerem commented

2026-02-27 08:15:42 +03:00

Author

Owner

@zozzz commented on GitHub (Mar 7, 2023):

@martadinata666 Not the user name is my problem.

@nitnelave Ok. I just think this is a bug, but just inconsistent dn naming with (objectClass=groupOfNames).

# ldapsearch "(objectClass=groupOfNames)"

dn: cn=admin_group,ou=groups,dc=example,dc=com
objectclass: groupOfUniqueNames

dn: cn=lldap_admin,ou=groups,dc=example,dc=com
objectclass: groupOfUniqueNames

# ldapsearch "(objectClass=person)" memberof

dn: uid=admin,ou=people,dc=example,dc=com
memberof: uid=lldap_admin,ou=groups,dc=example,dc=com

# dn is changed from cn=admin_group,ou=groups,dc=example,dc=com
memberof: uid=admin_group,ou=groups,dc=example,dc=com

But, maybe is a good idea to use same dn everywhere.

@zozzz commented on GitHub (Mar 7, 2023): @martadinata666 Not the user name is my problem. @nitnelave Ok. I just think this is a bug, but just inconsistent _dn_ naming with `(objectClass=groupOfNames)`. ```yaml # ldapsearch "(objectClass=groupOfNames)" dn: cn=admin_group,ou=groups,dc=example,dc=com objectclass: groupOfUniqueNames dn: cn=lldap_admin,ou=groups,dc=example,dc=com objectclass: groupOfUniqueNames ``` ```yaml # ldapsearch "(objectClass=person)" memberof dn: uid=admin,ou=people,dc=example,dc=com memberof: uid=lldap_admin,ou=groups,dc=example,dc=com # dn is changed from cn=admin_group,ou=groups,dc=example,dc=com memberof: uid=admin_group,ou=groups,dc=example,dc=com ``` But, maybe is a good idea to use same _dn_ everywhere.

kerem commented

2026-02-27 08:15:42 +03:00

Author

Owner

@nitnelave commented on GitHub (Mar 7, 2023):

Alright, phrased like that it's totally fair :)

@nitnelave commented on GitHub (Mar 7, 2023): Alright, phrased like _that_ it's totally fair :)

kerem referenced this issue

2026-02-27 08:18:06 +03:00

[PR #177] [MERGED] Introduce a read-only user #592