LDAP groups should be in a different OU than users

[jamshid]

Name and Version

bitnami/openldap:2.6

What steps will reproduce the bug?

Create an LDAP container with a user and group, why are groups in the same OU as users?

What is the expected behavior?

Groups should be under a different ou, not users or people right? E.g.
https://serverfault.com/questions/87079/openldap-posix-groups-account

# User primary group
dn: cn=ussergroup,ou=groups,dc=me,dc=com
...
# User account
dn: uid=user,ou=users,dc=me,dc=com

Please add a LDAP_GROUP_OU similar to LDAP_USER_DC and use that in the template.
Btw LDAP_USER_DC should probably be renamed to "LDAP_USER_OU", since it defaults to ou=users not a dc?

What do you see instead?

dn: cn=mygroup,ou=users,dc=example,dc=org

Additional information

this originally came up in https://github.com/bitnami/bitnami-docker-openldap/issues/2

[carrodher]

Thanks for reporting this issue. Would you like to contribute by creating a PR to solve the issue? The Bitnami team will be happy to review it and provide feedback. Here you can find the contributing guidelines.

[github-actions]

This Issue has been automatically marked as "stale" because it has not had recent activity (for 15 days). It will be closed if no further activity occurs. Thanks for the feedback.

[github-actions]

Due to the lack of activity in the last 5 days since it was marked as "stale", we proceed to close this Issue. Do not hesitate to reopen it later if necessary.

[jamshid]

@dgomezleon @barsikus007 this issue was not fixed. The env var was changed but the group created is still in ou=users instead of ou=groups. Adding -e LDAP_GROUP_OU=groups does not help.

docker run -d --name openldap -p 1389:1389 bitnami/openldap:latest

$ curl 'ldap://localhost:1389/dc=example,dc=org?*?sub?(objectclass=*)'
DN: ou=users,dc=example,dc=org
	objectClass: organizationalUnit

	ou: users

DN: cn=user01,ou=users,dc=example,dc=org
...
DN: cn=readers,ou=users,dc=example,dc=org
	cn: readers

	objectClass: groupOfNames

	member: cn=user01,ou=users,dc=example,dc=org
	member: cn=user02,ou=users,dc=example,dc=org

There should be a
DN: ou=groups,dc=example,dc=org
and that's where the readers group should live:
DN: cn=readers,ou=groups,dc=example,dc=org

[jamshid]

Here's the bug -- group creation is still referencing LDAP_USER_OU:

containers/bitnami/openldap/2.6/debian-12/rootfs/opt/bitnami/scripts/libopenldap.sh

Line 579 in 278116b

dn: ${LDAP_GROUP/#/cn=},${LDAP_USER_OU/#/ou=},${LDAP_ROOT}

I made a PR @dgomezleon @barsikus007 lmk if any problems:
#77099

[jamshid]

Thanks @alvneiayu for merging the PR. Any idea when a new bitnami/openldap image build (2.6.10?) will be available?

[carrodher]

The latest tags were pushed some hours ago, see https://hub.docker.com/r/bitnami/openldap/tags

[jamshid]

Thanks @carrodher but is there something else that has to be done to get the change into bitnami/openldap:latest? It's still using the old code:

% docker pull bitnami/openldap:latest
latest: Pulling from bitnami/openldap
Digest: sha256:e1929afbb392b76baa1c4508bdaff613423b478620a7130d28c4cd9f39fef084
Status: Image is up to date for bitnami/openldap:latest
docker.io/bitnami/openldap:latest

% docker run bitnami/openldap:latest fgrep 'dn: ${LDAP_GROUP/' opt/bitnami/scripts/libopenldap.sh

dn: ${LDAP_GROUP/#/cn=},${LDAP_USER_OU/#/ou=},${LDAP_ROOT}

[jamshid]

Ah this bitnami-bot commit reverted my change. IDK why. Just asked on the commit.

Maybe it is rebuilding 2.6.9 for some reason and doesn't want to introduce a change. But seems it shouldn't break/revert what's on main.

f05a597

commit f05a5976bde823582ed29ce1d3a7bb8a7c60d9bd
Author: Bitnami Bot <[email protected]>
Date:   Mon Feb 10 20:31:38 2025 +0100

    [bitnami/openldap] Release openldap-2.6.9-debian-12-r4 (#77147)
    
    Signed-off-by: Bitnami Bot <[email protected]>

commit d8158d6a510a222cbb5f36bd4abf3b378343e1e6

[alvneiayu]

Hi @jamshid

No worries, I will fix it.

Sorry for the inconveniences

Alvaro

[alvneiayu]

here we go @jamshid

https://github.com/bitnami/containers/blob/main/bitnami/openldap/2.6/debian-12/rootfs/opt/bitnami/scripts/libopenldap.sh#L579

Sorry for the noise. My fault. Now the container is already released. And again, thanks a lot for your contribution.

[jamshid]

Thanks @alvneiayu! I confirmed bitnami/openldap:latest is correct. Hopefully it gets a release tag like 2.6.10 soon so users can pin to it.