Can't find members of a group, if prepopulation is used

[igorbljahhin]

Hi!

I can't get the search of "memberOf" working. My setup using docker-compose is following:

version: "2"

services:
openldap:
image: dinkel/openldap:latest
container_name: openldap
environment:
SLAPD_ORGANIZATION: "a company"
SLAPD_DOMAIN: "rosinad.com"
SLAPD_PASSWORD: "admin"
SLAPD_CONFIG_PASSWORD: "config"
SLAPD_ADDITIONAL_MODULES: "memberof"
volumes:
- data_openldap:/etc/ldap
- data_openldap_config:/var/lib/ldap
- ./docker/openldap:/etc/ldap.dist/prepopulate
ports:
- "389:389"

I have three files in ./docker/openldap: 01-base.ldif, 02-users.ldif and 03-groups.ldif with following content (only important parts are shown):

01-base.ldif:
dn: ou=people,dc=rosinad,dc=com
objectclass: organizationalUnit
ou: People

dn: ou=groups,dc=rosinad,dc=com
objectclass: organizationalUnit
ou: Groups

02-users.ldif:
dn: uid=seagate_user,ou=people,dc=rosinad,dc=com
cn: Seagate User
sn: User
gidnumber: 10000
homedirectory: /home/users/seagate_user
objectClass: posixAccount
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
loginShell: /bin/bash
uid: seagate_user
uidnumber: 1001
userpassword: seagate_user

03-groups.ldif:
dn: cn=GPWUSERS,ou=groups,dc=rosinad,dc=com
cn: GPWUSERS
objectClass: groupofnames
member: uid=seagate_user,ou=people,dc=rosinad,dc=com

and search by the query "(&(objectClass=person)(memberOf=cn=GPWUSERS,ou=groups,dc=rosinad,dc=com))" is returning nothing.

But if I manually add the group with member after OpenLDAP is started, then the search is returning that one result.

My guess is that memberOf module is enabled after my files are prepopulated, but if I look at the source code of entrypoint script, then I see that prepopulation is performed in the end of the script.

Could you give me some hints that could be wrong with my approach?

thanks!

[xgodon]

i think the easiest solution would be to add your ldif files after the service start, as it seems to make memeberof effective.
Or you can build your own image and do somegarage stuff like launching a script in the background that wait 10seconds and then populate the DIT (after the 10 sec, the ldap will be started).

[duketwo]

Refactor the entrypoint.sh script?

Edit: Doesn't seem to work, currently struggling with the same problem. Will post an update if I found a solution.

[duketwo]

I get these in the logs: 594bf5ec <= bdb_equality_candidates: (memberOf) not indexed

[duketwo]

slapadd doesn't work with overlays, like memberOf. So the only workaround I'm aware of would be adding the groups with ldapadd while slapd is running.

[duketwo]

I'll add supervisord and add a script which checks if slapd is already running and then injecting the prepopulated data once.

[duketwo]

It's working fine when doing the said above. The supervisord script I've written therefore:

https://pastebin.c4s.de/asajafevul.bash

[srollinet]

Hi @duketwo

I have the same problem, but I don't fully understand what to do to make your solution work.
Could you post a full procedure or a working fork?

Thanks a lot!

[xgodon]

i assume you have to delete the prepopulate part of the original entrypoint.sh (the

if [[ "$first_run" == "true" ]]; then
if [[ -d "/etc/ldap/prepopulate" ]]; then
for file in ls /etc/ldap/prepopulate/*.ldif; do
slapadd -F /etc/ldap/slapd.d -l "$file"
done
fi
fi

block)
you also have to run his script from the entrypoint.sh.

[olegbakhirev]

@xgodon Unfortunatelly script is gone :( And not clear what was there. Does that require adding some libraries to the image?
@duketwo could you please repost it?

[duketwo]

https://github.com/duketwo/Shib-Idp/blob/master/ldap/populate.sh

If anybody still needs that

[blizzz]

What is possible to do in the entrypoint file is to:

• enable job control by set -m
• start slapd and sent it to background "$@" &
• sleep for 2 seconds…
• instead of slapadd use ldapadd to import prepopulation files
  • requires ldap-utils to be installed within the dockerfile
• bring slapd back to foreground fg

It's somewhat ugly though… or @dinkel do you think this would be tolerable to fix the issue?