The order of your steps looks wrong. You should do the following:

• Configure and enable the memberOf plug-in.
• Restart DS to load the mmeberOf plug-in
• Add "objectclass: inetUser" to your user entry.
• Add "member: " to your group entry.

This should result in your user entry having the "memberOf" attribute added to it. You don't need to run the fixup task unless you have existing "member" attributes defined in your database and you want to generate "memberOf" values from the existing membership information.

Hi nkinder,

I already followed your step as the 389 document mentioned before I filed this ticket but it did not work. The bad thing is that I could not find any useful log message of my activity.
Do you have any other particular configuration to enable the "memberOf" plugin other than setting up the details in the "Advnaced" menu?

So, do you suggest that I do not even have to have "groupOfNames" objectClass in the group entry?

Any debugging messages that I can make to track down what went wrong with my memberOf plugin?

Regards,

Please supply your memberOf config entry (cn=MemberOf Plugin,cn=plugins,cn=config). You can retrieve it via ldapsearch, or you can copy it out of /etc/dirsrv/slapd-/dse.ldif.

I would also like to see a copy of your group entry and your user entry.

The "groupOfNames" objectclass is what allows your group entry to have "member" attributes. It is needed to satisfy schema checking.

You can check for any error messages in /var/log/dirsrv/slapd-/errors. If you don't see any errors at the default level, you can enable "Plug-in debugging" level logging to see if it provides any clues. There are details on setting the log level here:

http://port389.org/wiki/FAQ#Troubleshooting

Is this the one that you need to know from my /etc/dirsrv/slapd-leopard/dse.ldif?
{{{
dn: cn=MemberOf Plugin,cn=plugins,cn=config
objectClass: top
objectClass: nsSlapdPlugin
objectClass: extensibleObject
cn: MemberOf Plugin
nsslapd-pluginPath: libmemberof-plugin
nsslapd-pluginInitfunc: memberof_postop_init
nsslapd-pluginType: postoperation
nsslapd-pluginEnabled: on
nsslapd-plugin-depends-on-type: database
memberofgroupattr: uniqueMember
memberofattr: memberOf
nsslapd-pluginId: memberof
nsslapd-pluginVersion: 1.2.11.15
nsslapd-pluginVendor: 389 Project
nsslapd-pluginDescription: memberof plugin
modifiersName: cn=directory manager
modifyTimestamp: 20131015044619Z
}}}

• group entry:
  {{{

Entry 1: cn=lock,ou=Groups,dc=crest,dc=iu,dc=edu

dn: cn=lock,ou=Groups,dc=crest,dc=iu,dc=edu
cn: lock
gidnumber: 54
member: uid=webyrd,ou=People,dc=crest,dc=iu,dc=edu
memberuid: webyrd
objectclass: posixGroup
objectclass: top
objectclass: groupOfNames
userpassword: {crypt}x
}}}

• user entry
  {{{

Entry 1: uid=webyrd,ou=People,dc=crest,dc=iu,dc=edu

dn: uid=webyrd,ou=People,dc=crest,dc=iu,dc=edu
cn: William Edward Byrd
gecos: William Edward Byrd,,,
gidnumber: 4002
homedirectory: /u/webyrd
loginshell: /bin/bash
objectclass: account
objectclass: posixAccount
objectclass: top
objectclass: shadowAccount
objectclass: inetUser
shadowlastchange: 15807
shadowmax: 99999
shadowwarning: 7
uid: webyrd
uidnumber: 21373
userpassword: {crypt}!!
}}}

Yes, as I mentioned earlier, I already checked /var/log/dirsrv/slapd-leopard/errors and there was no error message about this.
OK, I will try to enable the debugging mode and then see if it helps me to find any clues.

Thanks,

Replying to [comment:4 dikim]:

Is this the one that you need to know from my /etc/dirsrv/slapd-leopard/dse.ldif?
{{{
dn: cn=MemberOf Plugin,cn=plugins,cn=config
objectClass: top
objectClass: nsSlapdPlugin
objectClass: extensibleObject
cn: MemberOf Plugin
nsslapd-pluginPath: libmemberof-plugin
nsslapd-pluginInitfunc: memberof_postop_init
nsslapd-pluginType: postoperation
nsslapd-pluginEnabled: on
nsslapd-plugin-depends-on-type: database
memberofgroupattr: uniqueMember
memberofattr: memberOf
nsslapd-pluginId: memberof
nsslapd-pluginVersion: 1.2.11.15
nsslapd-pluginVendor: 389 Project
nsslapd-pluginDescription: memberof plugin
modifiersName: cn=directory manager
modifyTimestamp: 20131015044619Z
}}}

Yes, this shows what your problem is. The memberOf plugin is currently configured to watch for "uniqueMember" attributes in the group entry, not the "member" attribute. Since you are using the "member" attribute in groups, you need to modify your memberOf plug-in config to match. You can stop DS, then directly edit dse.ldif to set "memberofgroupattr: member". Alternatively, you can edit through Console or use ldapmodify to make the change.

After the change is made, run the fixup-memberof.pl script to correct the entries that you have already created.

Great! Yes, setting "memberofgroupattr: member" in dse.ldif fixed the problem.

Thanks a lot.

Replying to [comment:6 dikim]:

Great! Yes, setting "memberofgroupattr: member" in dse.ldif fixed the problem.

Thanks a lot.

Great! I'll go ahead and close this ticket.

389-ds-base is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in 389-ds-base's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/389ds/389-ds-base/issues/899

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.