Synchronize posixGroup to groupOfNames


In a standard LDAP directory, you can have several kind of groups, each one represented by a specific object class, for example:

  • posixGroup

  • groupOfNames

  • groupOfUniqueNames

  • groupOfURLs

You may need to have both of them, for example posixGroup and groupOfNames, as posixGroup entries will be used for system authentication (PAM or SSSD) and groupOfNames for web applications authorizations.

This tutorial will explain how to sync members between a posixGroup entry and a groupOfNames entry, so you just have to edit one entry to manage membership.

Let’s go

This tutorial is an adaptation of Synchronize OpenLDAP groups to Active Directory groups, with these differences:

  • We sync posixGroup to groupOfNames instead of groupOfUniqueNames to AD group

  • There is only one directory (so only one connection), groups can be in different branches or in the same one

  • We suppose that all users are in ou=users branch, and that the RDN is based on uid attribute


Create a task group as a standard LSC task:





We define here a source service that will read POSIX groups, and a destination service that will manage standard groups:

    <connection reference="openldap" />
    <connection reference="openldap" />


We will now define properties:


Main properties

We define mainIdentifier and conditions:

<mainIdentifier>js:"cn=" + javax.naming.ldap.Rdn.escapeValue(srcBean.getDatasetFirstValueById("cn").toLowerCase()) + ",ou=groups,dc=example,dc=com"</mainIdentifier>

Object Class

We force the values of objectClass attribute:



We convert uid values into DN:

            var membersSrcUid = srcBean.getDatasetValuesById("memberUid");
            var membersDstDn = new java.util.ArrayList();
            for  (var i=0; i<membersSrcUid.size(); i++) {
                var memberSrcUid = membersSrcUid.get(i);
                var dn = "uid=" + memberSrcUid + ",ou=users,dc=example,dc=com";

Some explanations on this script:

  • We get uid of members in source in membersSrcUid

  • For each value, the corresponding DN is built with a simple concatenation

  • The DN is inserted into membersDstDn array

  • The membersDstDn array is returned to LSC