Just to clarify, we never disabled the 389 MemberOf plugin. My original
ldif dump after the upgrade to 1.2.5 had the 389 DS memberOf plugin
disabled. So it never was enabled. This probably meant little to us from
a functional standpoint because we already had the FreeIPA ipa_memberof
plugin installed and enabled.
To actually disable the plugin you need a restart after you change the
config, but please *do not* do that unless you want trouble :)
The memberof plugin does not change group memberships it only updates
the memberof attribute to keep it in sync with the member ones.
Do I need both of them enabled? Or will that cause additional misery? Of
the two, ipa-memberof and 389's memberOf plugin, which should I enable?
Freeipa-users mailing list