# example - ou=people,${..base_dn}
base_dn = "<user.base_dn>" <1>
- # example - (&(objectClass=posixUser)(uid=%{%{Stripped-User-Name}:-%{User-Name}}))
+ # example - (&(objectClass=posixAccount)(uid=%{%{Stripped-User-Name}:-%{User-Name}}))
filter = "(&(<user.filter>)(<user_uid_attribute>=%{%{Stripped-User-Name}:-%{User-Name}}))" <2>
}
}
a user's login account, and another represented a Human Resources record,
the `user.filter` value could be changed to only return objects with an
object class that indicated the object represented login account
- e.g. `(&(objectClass=posixUser)(uid=...))`.
+ e.g. `(&(objectClass=posixAccount)(uid=...))`.
3. Change the scope of the search to be more restritive. If the additional user
object is located in a child object under the user base_dn, setting `user.scope`
to 'one' will resolve user object ambiguity by restricting the search to the
----
====
-== Editing mods-available/ldap to enable SSS
+== Editing mods-available/ldap to enable Server Side Sorting
[source,config]
----
# example - base_dn = "ou=people,${..base_dn}"
base_dn = "<path_from_base_dn_to_user_obj_dn>,${..base_dn}" <5>
- # example = "(&(uid=%{%{Stripped-User-Name}:-%{User-Name}})(objectClass=posixUser))"
+ # example = "(&(uid=%{%{Stripped-User-Name}:-%{User-Name}})(objectClass=posixAccount))"
filter = '(&(<user_uid_attribute>=%{%{Stripped-User-Name}:-%{User-Name}})(<user_filter>))' <6>
}
}
Repeat the search for user objects using a filter that matches a user known
to be members of one or more groups e.g.
-`(&(objectClass=posixUser)(uid=doctopus))`.
+`(&(objectClass=posixAccount)(uid=doctopus))`.
- If the result shows a attribute containing the DN of known group, the LDAP
server implements _variant 1_.
.Searching for a user object and returning operational attributes
```
-ldapsearch -z 10 -x -H ldap://localhost:389 -b "dc=example,dc=com" "(ObjectClass=posixUser)" "*" "+"
+ldapsearch -z 10 -x -H ldap://localhost:389 -b "dc=example,dc=com" "(ObjectClass=posixAccount)" "*" "+"
```