-
Type:
Bug
-
Resolution: Unresolved
-
Priority:
Major
-
Affects Version/s: COmanage Registry 4.5.0 (Trusted Trail)
-
Component/s: Registry Plugins
-
None
The LDAP Provisioner explicitly populates values for the memberUid attribute for objectClass posixGroup using Identifiers configured for UID Type from the UnixCluster configuration:
if(!empty($cluster[0]['uid_type'])) { |
// Now pull the set of identifiers for this UID type |
$members = $this->CoLdapProvisionerDn |
->CoGroup
|
->CoGroupMember
|
->mapCoGroupMembersToIdentifiers($activeGroupMembers, $cluster[0]['uid_type']); |
The uid_type from the UnixCluster.php model, however, points to Identifiers holding numeric values, as opposed to 'username_type', which points to Identifiers holding non-numeric values.
As a result, the values for memberUid hold numeric values, e.g.
dn: cn=redmonp,ou=groups,o=ITRSS,o=CO,dc=itrss,dc=org
|
objectClass: eduMember
|
objectClass: posixGroup
|
cn: redmonp
|
gidNumber: 116770
|
memberUid: 116770
|
The wiki documentation for the LDAP Provisioner is mute on the memberUid attribute and does not mention it at all.
Curiously RFC 2307, which defines memberUid, is mute on what value goes into it. See https://datatracker.ietf.org/doc/html/rfc2307
The name of the attribute, however, includes 'uid' and it appears that most uses for the attribute do expect the value to NOT be numeric.
Also note that memberUid is considered deprecated in favor of other approaches.