Hi, I have a FreeIPA 4.10 installation with a Squid proxy server using the ext_kerberos_ldap_group_acl helper for authorizations. At some point the helper stopped working correctly. The problem is that ext_kerberos_ldap_group_acl uses the memberuid attribute, which is only available in the "cn=groups,cn=compat,dc=labeconomia,dc=unich,dc=it" subtree. Unfortunately, it seems that traversing the compat subtree is only possible when specifying a search base.
For example, the command ldapsearch -H <host> "(uid=studente)" returns the user "uid=studente,cn=users,cn=accounts,dc=labeconomia,dc=unich,dc=it" If I want to get the corresponding user in the compat subtree, I need to specify a search base as in ldapsearch -H <host> -b "cn=compat,dc=labeconomia,dc=unich,dc=it" "(uid=studente)" which correctly returns "uid=studente,cn=users,cn=compat,dc=labeconomia,dc=unich,dc=it" Now I wonder: is this the correct behavior ? And if this is correct, why did ext_kerberos_ldap_group_acl use to work in the past ? Thanks for any help. _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-le...@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
