starred/lldap-lldap

Fork 0

mirror of https://github.com/lldap/lldap.git synced 2026-04-25 16:25:55 +03:00

[GH-ISSUE #643] [FEATURE REQUEST]: Create groups from LDAP (for Terraform) #235

New issue

Closed

opened 2026-02-27 08:16:04 +03:00 by kerem · 7 comments

kerem commented

2026-02-27 08:16:04 +03:00

Owner

Originally created by @imyller on GitHub (Aug 9, 2023).
Original GitHub issue: https://github.com/lldap/lldap/issues/643

Adding groups with LDAP protocol from Terraform LDAP provider fails:

 LDAP Result Code 34 "Invalid DN Syntax": Unexpected DN format. Got "uid=id,ou=groups,dc=db,dc=<redacted>", expected: "uid=id,ou=people,dc=db,dc=<redacted>"

Error implies that LLDAP forces new object in ou=people DN while request clearly sends DN ou=groups

Originally created by @imyller on GitHub (Aug 9, 2023). Original GitHub issue: https://github.com/lldap/lldap/issues/643 Adding groups with LDAP protocol from Terraform LDAP provider fails: ``` LDAP Result Code 34 "Invalid DN Syntax": Unexpected DN format. Got "uid=id,ou=groups,dc=db,dc=<redacted>", expected: "uid=id,ou=people,dc=db,dc=<redacted>" ``` Error implies that LLDAP forces new object in `ou=people` DN while request clearly sends DN `ou=groups`

kerem

2026-02-27 08:16:04 +03:00

closed this issue
added the
enhancement

backend

integration

ldap
labels

kerem commented

2026-02-27 08:16:04 +03:00

Author

Owner

@nitnelave commented on GitHub (Aug 9, 2023):

Creating groups via LDAP is not yet supported.

@nitnelave commented on GitHub (Aug 9, 2023): Creating groups via LDAP is not yet supported.

kerem commented

2026-02-27 08:16:04 +03:00

Author

Owner

@ddiawara commented on GitHub (Aug 10, 2023):

others way to do it ?

@ddiawara commented on GitHub (Aug 10, 2023): others way to do it ?

kerem commented

2026-02-27 08:16:04 +03:00

Author

Owner

@nitnelave commented on GitHub (Aug 10, 2023):

No automatic way, you would have to create the groups manually on the web interface (or script it via the graphql API)

@nitnelave commented on GitHub (Aug 10, 2023): No automatic way, you would have to create the groups manually on the web interface (or script it via the graphql API)

kerem commented

2026-02-27 08:16:04 +03:00

Author

Owner

@ibizaman commented on GitHub (Sep 2, 2023):

@nitnelave is this planned or wanted? I don't have any idea when but it's something I'd be comfortable tackling. I'd also be happy to discuss any architectural considerations before implementing something like this. Btw, I'd like to be able to declare groups declaratively through the configuration file.

@ibizaman commented on GitHub (Sep 2, 2023): @nitnelave is this planned or wanted? I don't have any idea _when_ but it's something I'd be comfortable tackling. I'd also be happy to discuss any architectural considerations before implementing something like this. Btw, I'd like to be able to declare groups declaratively through the configuration file.

kerem commented

2026-02-27 08:16:04 +03:00

Author

Owner

@nitnelave commented on GitHub (Sep 2, 2023):

Hey @ibizaman ! This issue is not in my roadmap for now, and anyway I have precious little time these days (I don't spend as much time on LLDAP as I'd like!)
If you were to tackle it, it should be a nice task for a new contributor. The infrastructure is already in place, the only thing to do is to map the LDAP message to the internal group creation. And we already have something in place for users, so there's a template you can follow.

Regarding declaring the groups in a config file, I'm not convinced:

is it only for first time setup?
is it a complete list of groups, or just a minimum? What if one of the groups gets deleted?
in case of a HA setup, which node does the initialization?

There are several answers to these questions, and not everyone will agree on them.

This sounds like extra logic that doesn't really belong in the LLDAP project. With the API (either the existing graphql or through LLDAP if you add it) it's easy to write a script implementing that logic. It could be part of the entry point.

That said, I'd be willing to provide in the repo a script that loads users/groups from a config file if you want to write that. The best would probably be to write it in rust, to have the same language throughout the repo, be able to share code and minimize the dependencies.

@nitnelave commented on GitHub (Sep 2, 2023): Hey @ibizaman ! This issue is not in my roadmap for now, and anyway I have precious little time these days (I don't spend as much time on LLDAP as I'd like!) If you were to tackle it, it should be a nice task for a new contributor. The infrastructure is already in place, the only thing to do is to map the LDAP message to the internal group creation. And we already have something in place for users, so there's a template you can follow. Regarding declaring the groups in a config file, I'm not convinced: - is it only for first time setup? - is it a complete list of groups, or just a minimum? What if one of the groups gets deleted? - in case of a HA setup, which node does the initialization? There are several answers to these questions, and not everyone will agree on them. This sounds like extra logic that doesn't really belong in the LLDAP project. With the API (either the existing graphql or through LLDAP if you add it) it's easy to write a script implementing that logic. It could be part of the entry point. That said, I'd be willing to provide in the repo a script that loads users/groups from a config file if you want to write that. The best would probably be to write it in rust, to have the same language throughout the repo, be able to share code and minimize the dependencies.

kerem commented

2026-02-27 08:16:04 +03:00

Author

Owner

@ibizaman commented on GitHub (Sep 7, 2023):

About loading from a config file, I was thinking about deploying code with NixOS which as you may know is declarative and have a list of groups defined in NixOS. But having a second binary talking to the API works too.

Thanks for the explanation of how to implement this. It makes sense indeed.

@ibizaman commented on GitHub (Sep 7, 2023): About loading from a config file, I was thinking about deploying code with NixOS which as you may know is declarative and have a list of groups defined in NixOS. But having a second binary talking to the API works too. Thanks for the explanation of how to implement this. It makes sense indeed.

kerem commented

2026-02-27 08:16:05 +03:00

Author

Owner

@fsdrw08 commented on GitHub (Mar 20, 2024):

maybe we can try to use terraform graphql provider to do that

@fsdrw08 commented on GitHub (Mar 20, 2024): maybe we can try to use terraform graphql provider to do that

kerem referenced this issue

2026-02-27 08:18:16 +03:00

[PR #235] [MERGED] Enabling UID:GID #637