multi-valued ldap-group attributes in rlm_cache

2 Aug 2014

      Hi,

I am trying to cache ldap group membership like this:

modules {
  ldap ldap_xyz {
   [...]
   group {
    base_dn = "ou=Groups,dc=koko,dc=lala"
    filter = "(objectClass=groupOfNames)"
    membership_attribute = "memberOf"
    cacheable_name = "yes"
   }
  }
  cache cache_xyz {
   [...]
   update {
    &control:ldap_xyz-Ldap-Group += &control:ldap_xyz-Ldap-Group
   }
  }
}

[...]
authorize {
  [...]
  update control {
   Cache-Read-Only := yes
  }
  cache_xyz
  if (notfound) {
   ldap_xyz
   cache_xyz
  }
  [...]
}

I can see rlm_ldap populate control:Ldap-Group:

Sat Aug  2 12:12:55 2014 : Debug: Added control:ldap_xyz-Ldap-Group with 
value "abc"
Sat Aug  2 12:12:55 2014 : Debug: Added control:ldap_xyz-Ldap-Group with 
value "def"
[...]

But it looks like rlm_cache only caches the first value:

Sat Aug  2 12:12:56 2014 : Debug: (4)   cache_xyz : Adding to cache 
entry:
Sat Aug  2 12:12:56 2014 : Debug: (4)   cache_xyz : 
	control:ldap_xyz-Ldap-Group += &ldap_xyz-Ldap-Group -> 'abc'

And the next cache lookup only shows the first value:

Sat Aug  2 12:13:02 2014 : Debug: (9)   cache_xyz : Merging cached 
control list:
Sat Aug  2 12:13:02 2014 : Debug: (9)   cache_xyz : 	ldap_xyz-Ldap-Group 
+= 'abc'

Is this supposed to work? I am using 3.0.4 rc1.

Thanks,
Z.

multi-valued ldap-group attributes in rlm_cache

Zenon Mousmoulas