Hi,
I created a dit on a Centos 6.5 box that looks something like this:
........dc=name,dc=com................................
| | |
| | |
ou=users ou=systems........... ou=policies
| | | |
| | | |
user1 cn=group1 cn=group2 cn=ppolicy
user2 | |
user3 | |
| |
user1 user2
user2 user3
I created my users, and I added sever "linux groups" using the ldif file:
dn: cn=dev,ou=systems,dc=ehs,dc=edu
cn: dev
gidNumber: 4005
objectClass: posixGroup
My goal was to simulate an entry that you'd find in the /etc/group file
on a linux system. So if I added people to this group using the ldif
file:
dn: cn=dev,ou=systems,dc=ehs,dc=edu
changetype: modify
add: memberuid
memberuid: user1
memberuid: user2
So while user1 and user2 are in the default group "users", I wanted them
to be
able to change the group on their files to "dev" in order to protect
their development
files.
Now, this seemed to work, and when I went on my client and did a command
"groups user1",
I saw "users" and "dev"
However yesterday I added another group called "team0" with gid 22222
using the following ldif
file:
dn: cn=team0,ou=systems,dc=ehs,dc=edu
cn: team0
gidNumber: 22222
objectClass: posixGroup
When I was logged into my client machine (Centos 5.5 box) and did a
groups on an old
user, it showed "users", "dev" and now "team0" although I never added
that user to the new
group.
I cleaned the client cache using the nscd -i invalidate=group command,
and then I removed
all the cached directories in /var/db/nscd, and rebooted, but that new
group seems to have been
applied to everyone.
I might have screwed up the creation of my DIT, but I was thinking that
things were working
ok since I could added "unix groups" that are visible with the "getent
group" command on a client,
I could add users into these groups and changed the group of files to
lock out some users, but
I don't understand this behavior now.
I have about 6 groups defined and the last one I created yesterday is
the only one that seems to
get applied to all users.
I'd appreciate any help you could give.... I'm scratching my head on
this one.
Thanks.
