Manage Group Memberships
Overview
At checkout the broker adds the requesting user to an OpenLDAP group; at checkin it removes them. Two Bash scripts use standard LDAP utilities (ldapsearch, ldapmodify) and ignore any email suffix on the username. Groups use the posixGroup objectClass.
Before You Begin
- The Access Broker is deployed and connected
- Linux broker host with
ldap-utilsinstalled (sudo apt-get install ldap-utils) - An existing OpenLDAP server; users under
ou=users, groups underou=groups
Configuration
Set these in the scripts (or via env vars / a secret store — do not hardcode in production):
| Variable | Example |
|---|---|
LDAP_SERVER | ldap://localhost |
BASE_DN | dc=example,dc=com |
BIND_DN | cn=admin,dc=example,dc=com |
BIND_PASSWORD | bind password |
Checkout / Checkin
Full scripts: add_user_to_group.sh · remove_user_from_group.sh
# checkout — add member
ldapmodify -x -H "$LDAP_SERVER" -D "$BIND_DN" -w "$BIND_PASSWORD" <<EOF
dn: cn=$GROUP,ou=groups,$BASE_DN
changetype: modify
add: memberUid
memberUid: $USER
EOF
# checkin — delete member (remove_user_from_group.sh) uses: delete memberUidConfigure in Britive
Create the permission
Resource Manager → Resource Type Permissions → New Permission. Language = Shell. Paste the add script as Checkout and the remove script as Checkin. Declare the LDAP connection variables and GROUP; the user is system-defined.
Create a profile and policy
Create a profile (e.g. 4h), set GROUP, add the permission, and add a policy assigning members by tag.
Verify
ldapsearch -x -H "$LDAP_SERVER" -b "cn=<group>,ou=groups,$BASE_DN" memberUid
# the user's uid appears during checkout, gone after checkinTroubleshoot
| Symptom | Cause | Fix |
|---|---|---|
| “user does not exist” | User not under ou=users | Confirm the user DN and BASE_DN |
| Group modify fails | Group missing or wrong objectClass | Ensure a posixGroup exists at cn=<group>,ou=groups |
| Bind error | Wrong BIND_DN/BIND_PASSWORD | Verify bind credentials; prefer LDAPS in production |
Next Steps
Last updated on