PAM-LDAP authentication by group

[Aksoy]

Hi,

We are using LDAP to authenticate our users through nsswitch & pam.

System is working quite fine.

We are looking at ways
- to use the same LDAP database to authenticate users on several machines
- and at same time being able to restrict who can access what.

The nice way would be to create user groups per host(ex.cn=group-for-host1, ou=groups, o=mycompany.com)

I am having difficulty in defining the search filter in ldapux that would only pick users from a specific group

I have tried with no success:

1- (objectclass=groupofuniquenames)

2- (|(objectclass=posixaccount)(objectclass=groupofuniquenames))

3- (&(cn=group-for-host1)(uid=*))

We are running hp-ux 11.11 & LDAP iplanet 5.0

Thanks for any hint
Selahattin

[Mike Lancaster]

I have tried this same thing and gotten nowhere.. anyone gotten this sort of thing to work yet?

[Lee Hundley]

Maybe:

(&(objectclass=posixgroup)(cn=))

I'm not sure exactly info you're trying to isolate here...