hello, I did manage to get my linux users sync with lldap on my systems, but I can't find a way to synchronize posix groups, did anybody managed to make this work? ldapsearch correctly returns group entries:

# jerome, groups, xxxxxxxxxxxxxxxxx
dn: cn=jerome,ou=groups,dc=xxxxxxxxxxxx
objectclass: groupOfUniqueNames
uid: jerome
cn: jerome
member: uid=jerome,ou=people,dc=xxxxxxxx
uniquemember: uid=jerome,ou=people,dc=xxxxxxxx
entryuuid: 2ee08f30-f1a2-35ec-952e-9f31beca81e5

getent passwd corretly returns the user:

jerome:*:1000:1000:jerome:/home/jerome:/bin/bash

but getent group is always emtpy here's what I do in nslcd:

txt
reconnect_invalidate passwd group
nss_initgroups_ignoreusers ALLLOCAL

pam_authz_search (&(unix-uid=*)(uid=$username)(memberOf=cn=xxxxx,ou=groups,xxxxxxxxxxxxx))

# The search scope.
#scope sub

filter passwd (&(objectClass=posixAccount)(unix-uid=*))
map     passwd uidNumber unix-uid
map     passwd gidNumber unix-gid
map     passwd gecos uid
map     passwd homeDirectory "/home/${uid}"
map     passwd loginShell    "/bin/bash"

filter group (&(objectClass=groupOfUniqueNames)(unix-gid=*))                                                                                                                                                   
map group gidNumber unix-gid                                                                                                                                                                                   
map group memberUid member                                                                                                                                                                                     
                                                                                                                                                                                                               
validnames /.*/i

message has been deleted

Stupid question , but your groups have unix-gid?

yes they do

Alright, then I don't know. You can have a look at the LLDAP (verbose) logs to see what were the queries and what groups were returned, but if they're correctly returned then I'll leave it to the pam experts

alright thanks anyway

@rkj would you know?

after testing it does work, I can add users to sudo and the command

groups

returns the rights groups for each users maybe a bug in getent or something missing? idk at least it works now

Are you running a build from the latest master branch? (at least as of 'this month')

I'm using the latest docker image, that I pulled on Friday