How to create LDAP mapping for custom attribute

HCL Domino Domino Forum
1

Hi,

New to Notes. I have created a custom entry in the Notes database called memberOf and wants to map it to the LDAP server so that its search able from the LDAP interface. The documentation that I have read mentioned to put it in the schema database. I made a copy of the schema database and tried to add an entry but always error out. Is there a proper instruction on how to do this mapping?

The documentation doesn’t give proper steps on how to do this. Don’t know what syntax name for the new document needs to be. It errors out complaining about the type. Tied to copy and existing entry but it won’t allow me to edit the pasted entry.

Any help would be greatly appreciated!

Thanks,

Andrew

2

Subject: How to create LDAP mapping for custom attribute

Hi,

Here’s an updated directory FAQ the IBM Lotus Notes/Domino Directory Team has assembled about Domino directories. ---------

Keywords:

Domino Directories

LDAP - configuration , search, troubleshooting

SSO - single sign on

Directory Assistance

Directory Catalog

Active Directory - integration

Thank you,

JYR

3

Subject: How to create LDAP mapping for custom attribute

New to Notes. I have created a custom entry in the Notes database called memberOf and wants to map it to the LDAP server so that its search able from the LDAP interface. The documentation that I have read mentioned to put it in the schema database. I made a copy of the schema database and tried to add an entry but always error out. Is there a proper instruction on how to do this mapping?

Are you planning on maintaining this “memberOf” attribute with a program?

What will be the relationship between entries with this “memberOf” field and the Members of a Domino Group document?

Will you also make sure that the Group document’s Members fields reflect your memberOf scheme?

I’ll assume you plan on using your Domino directory Groups for purposes other than strictly for you app that uses memberOf, in which case you must maintain both Group.Members and Person.memberOf.

I infer that you have custom (probably ADSI) coded applications that take advantage of memberOf?

memberOf is not in any RFC. Active Directory has a memberOf attribute which only indicates direct group membership - Group Objects - Win32 apps | Microsoft Learn.

Domino (and other vendors) map the Group document to groupOfNames described in http://www.ietf.org/rfc/rfc2256.txt

It is not uncommon for LDAP client applications to have to adjust themselves to different vendor’s schemas. They typically do so with a configuration file. A common misconception is that because two vendors offer LDAPv3 services you can program them in the same way. This is rarely the case because of schema differences

Since groupOfNames is in rfc2256, a fairly universal way to query direct (non-nested) group membership is using something like this, which Domino services efficiently (AD does not, so they invented memberOf)

(&(objectClass=groupOfNames)(member=memberdn))

In the “Collaborative Cuisine” article mentioned in “Domino Directory FAQ” (google it) we describe how to unwind nested groups.

The documentation doesn’t give proper steps on how to do this. Don’t know what syntax name for the new document needs to be. It errors out complaining about the type. Tied to copy and existing entry but it won’t allow me to edit the pasted entry.

If you determine you really want to add this attribute, the syntax type should probably be a Name (I forget if we offer it as a Notes or LDAP name) since it is the value is presumably the name of a Group.

4

Subject: RE: How to create LDAP mapping for custom attribute

Hi,

Thanks for your input. We have created a custom field in the Persons form called memberOf to reference a view. So it should be fairly low maintenance as the data is pulled dynamically.

As for the need, we have a CMS application whose requirement is to look up the group membership of a person that logged in and then deliver content according to the group memberships. It would be highly inefficient to do a look up of all the groupnames to find which of those groups that person’s name is in. Its much easier to read the list from the memberOf attribute of the person who logged in.

I have successfully pulled the memberOf information into a view and display it in the form. I have also successfully added the memberOf field in my names.nsf. The server automatically created an entry in the schema.nsf and maps memberOf in the notes directory to the memberOf field in names.nsf. However, the memberOf attribute doesn’t show up in my LDAP searches.

Any idea if I am missing anything to enable this? This should not be any different than adding any other custom fields.

Thanks,

Andrew

5

Subject: RE: How to create LDAP mapping for custom attribute

Thanks for your input. We have created a custom field in the Persons form called memberOf to reference a view. So it should be fairly low maintenance as the data is pulled dynamically.

What are the semantics of memberOf. Does it include nested group memberships or direct membership only (like Active Directory)?

The built-in $ServerAccess view already reveals direct group membership, returning Domino Group documents marked for security.

As for the need, we have a CMS application whose requirement is to look up the group membership of a person that logged in and then deliver content according to the group memberships. It would be highly inefficient to do a look up of all the groupnames to find which of those groups that person’s name is in. Its much easier to read the list from the memberOf attribute of the person who logged in.

Is CMS an LDAP application? If so, I highly recommend you use the traditional direct group membership search

(&(objectClass=groupOfNames)(member=memberdn))

This search internally uses $ServerAccess.

In ND8, the Domino LDAP server implements a new dominoAccessGroups operational attribute for each object, which is a nested memberOf for security groups.

I have successfully pulled the memberOf information into a view and display it in the form. I have also successfully added the memberOf field in my names.nsf. The server automatically created an entry in the schema.nsf and maps memberOf in the notes directory to the memberOf field in names.nsf. However, the memberOf attribute doesn’t show up in my LDAP searches.

I’m guessing your searches are anonymous (which may not be a great idea). Only a limited set of attributes are available by default to anonymous searches. This list can be changed in your Domino LDAP server configuration.