title: OpenLDAP configuration using posixGroup and groupOfNames
body: <p>My requirement is to add the posixGroup and groupofNames object class together which add LDAP group using LDIF. Since both class are STRUCTURAL and cannot be added.</p>
  
  <p>To achieve this, I used the link where they mentioned to create a customPosixGroup. 
  <a href="https://devopsideas.com/openldap-linux-client-ldap-integration/" rel="nofollow noreferrer">https://devopsideas.com/openldap-linux-client-ldap-integration/</a></p>
  
  <p>Steps they mentioned in the link is </p>
  
  <blockquote>
    <h3>Overcoming posixGroup and groupOfNames caveat</h3>
    
    <p>We will be creating server group objects of type posixGroup under ou=server container. The posixgroup is required to provide the translation between group id numbers and their name. We’ll be providing access to servers based on membership of the groups. posixGroup’s member attribute is called memberUID and simply lists the uid of the member. Using this alone, there’s really no solid way to identify the specific distinguished name of the group member.</p>
    
    <p>The problem we have is, memberOf attribute is part of groupOfNames objectClass. We cannot use both posixGroup and groupOfNames together since both are STRUCTURAL objectClasses ( An entry can have only one STRUCTURAL object class ).</p>
    
    <p>To overcome this, we need to create a custom objectClass that will be a clone of posixGroup but of type  AUXILIARY instead of STRUCTURAL. Hence we will be able to use groupOfNames along with the custom posixGroup which is almost identical to posixGroup except the class type.</p>
    
    <p>The posixGroup exists in nis schema and hence we’ll make the change there.</p>
    
    <p>Create a file named <em>schema_update.ldif</em> with the below content</p>
  
  <pre><code>dn: cn={2}nis,cn=schema,cn=config
  changetype: modify
  add: olcObjectClasses
  olcObjectClasses: {13}( 1.3.6.1.1.1.2.13 NAME 'customposixGroup' DESC 'Abstraction of a group of accounts' AUXILIARY MUST ( cn $ gidNumber ) MAY ( userPassword $ memberUid $ description $ member ) )
  </code></pre>
    
    <p>{2} denotes the order. You can refer ‘/etc/ldap/slapd.d/cn\=config/cn\=schema’ to get this.</p>
    
    <p>We have named the custom group as <em>customposixGroup</em>. This contains all the attributes that are part of <em>posixGroup</em> except the class type marked as ‘AUXILIARY’.</p>
    
    <p>Run the below command to make the changes,</p>
  
  <pre><code>ldapmodify -W -D cn=admin,cn=config -f schema_update.ldif
  </code></pre>
  </blockquote>
  
  <p>I followed the steps and added the customposixGroup and after that added the group as</p>
  
  <pre><code>dn: cn=server_dev,ou=graylog,ou=rgroup,dc=rad,dc=com
  objectclass: customposixGroup
  objectclass: groupOfNames
  cn: server_dev
  gidNumber: 7000
  description: Server Dev Group
  member: uid=aron.francis,ou=People,dc=rad,dc=com
  </code></pre>
  
  <p>Then, On my Linux client side is sssd which I have configured but if I query using the id command.
  Here the group name is not getting displayed.</p>
  
  <p>I wanted help on why the group name is not getting displayed when I use the id
  command from the LDAP client.</p>
  
  <p>But if I use posixGroup instead of customPosixGroup and not groupOfName object class then the group
  name is getting displayed</p>
  
  <p>I am trying to configure the Openldap server setup but I am stuck at the above mentioned point. I need help on that and also wanted to know if I have been doing any wrong configuration. If you need more info kindly reply so that I can provide that.</p>