Clients not recognizing secondary LDAP groups?
- by Nick
I'm having an issue where users who are members of secondary groups in LDAP are not being recognized as members of that group by the client. In this case, user jdoe is not being recognized as a member of the projects group.
On the client, getent group shows:
projects:*:20001:1001,1002,1003,1004,1005,1006
and getent passwd shows:
jdoe:x:1003:10003:John Doe:/home/jdoe:/bin/bash
But if I log in to the client as jdoe, and run id, I get:
uid=1003(jdoe) gid=10003(jdoe) groups=24(cdrom),25(floppy),29(audio),44(video),46(plugdev),10003(jdoe)
It recognizes jdoe's primary group, and the secondary groups that are appended by the client to all LDAP users, but the LDAP secondary groups are not in the list. We can see that jdoe's id is in the projects group, so why is the projects group not showing when jdoe runs the id command?
The group objects are basic posixGroup entries, with a memberUid attribute for each of its members.
We are using OpenLDAP on Ubuntu 10.04 server and clients.
