freeipa

#9209 How to check user membership in the group?
Closed: invalid by rcritten. Opened by mhanusek.

Closed: invalid
Reopen Issue

Request for enhancement

As admin , I want to check my-user membership in group my-group.

Issue

I have configured the FreeIPA Server.
I try to check user membership by ldap3 library for python.
https://pypi.org/project/ldap3/

Steps to Reproduce

My script:

#!/usr/bin/env python3
host="192.168.254.106"
user_name = "user1"
pwd = "mypassword"
from ldap3 import Server, Connection, ALL, PLAIN, SASL, SUBTREE, ALL_ATTRIBUTES
server = Server(host, get_info=ALL)
conn = Connection(server, auto_bind=False, authentication=SASL, sasl_mechanism=PLAIN, sasl_credentials=(None, user_name, pwd))
if not conn.bind():
    print('error in bind', conn.result)
if not conn.start_tls():
    print('error in start_tls', conn.result)
total_entries = 0
conn.search(search_base = 'dc=fedora,dc=local',
         search_filter = '(objectClass=inetuser)',
         search_scope = SUBTREE,
         attributes = ['cn', 'givenName', 'gidNumber', 'uidNumber'],
         paged_size = 5)
total_entries += len(conn.response)
print("total_entries:", total_entries)
for entry in conn.response:
    print(entry['dn'], entry['attributes'])

Actual behavior

I can not get information about user membership.

Expected behavior

I can get information about user membership in my-group by ldapsearch or python's ldap3 library.
https://ldap3.readthedocs.io/en/latest/

Version/Release/Distribution

Fedora release 36 (Thirty Six)

freeipa-server-4.9.10-2.fc36.x86_64
freeipa-client-4.9.10-2.fc36.x86_64
pakiet ipa-server nie jest zainstalowany
pakiet ipa-client nie jest zainstalowany
389-ds-base-2.1.3-1.fc36.x86_64
pakiet pki-ca nie jest zainstalowany
krb5-server-1.19.2-11.fc36.x86_64

This would have been better to post on the user mail list since it isn't a bug.

You aren't asking for user memberships which is the root of the problem.

If you want to know what users are in a group you should search for the group and retrieve the member attribute. This will contain the DN of all entries who are members of the group.

If you want to look at a user and see what groups they are a member of, search for the user and retrieve the memberof attribute. This will contain the DN of all groups, roles, permission, privileges, etc. that user is a member of.

Also note that you're searching the entire tree which is not very efficient. For users use the search base cn=users,cn=accounts,$SUFFIX and for groups cn=groups,cn=accounts,$SUFFIX.

To get an idea of how/where an entry is stored using the ipa command-line tool you can add --raw --all options to view ldapsearch-like output. e.g. ipa user-show --all --raw admin

Using an IP address for the host may blow up in startTLS in case that's what you're seeing. I'd use a fqdn instead.

Metadata Update from @rcritten:
- Issue close_status updated to: invalid
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.