could you give a example bout ldap_group in the pam_authz module

[Jerry Jiangwei]

Hello folks,

I am working on the test work of Pam_authz,

there is access rule about ldap_group in the field, I am a bit confused about the documentation, so could you tell me how can I find some example configuration about ldap_group.

Thanks

-- Jerry Jiang

[Weltman, Ulf]

For ldap_group you need a static group (groupOfNames or groupOfUniqueNames) of which your user is a member. For example, if you're logging in as a user who maps to DN uid=myuser,ou=people,dc=example,dc=com then you might want a group like:
dn: cn=mygroup,ou=groups,dc=example,dc=com
objectClass: top
objectClass: groupofuniquenames
cn: mygroup
uniqueMember: uid=myuser,ou=people,dc=example,dc=com

And the pam_authz.policy file with this line:
allow:ldap_group:cn=mygroup,ou=groups,dc=example,dc=com