When running a Policy Server, this one isn't able to authorize users.
The Policy Server finds the group:
[09/11/2023][16:55:06.086][16:55:06][2139565][140124306269952][SmDsLdapProvider.cpp:2405][CSmDsLdapProvider::Search][][][][][][][][][][][][][][][][][][][(Search) Base: 'dc=example,dc=com', Filter: '(&(|(objectclass=groupOfNames)(objectclass=groupOfUniqueNames)(objectclass=group)(objectclass=top)(objectclass=exampleGroupOfNames))(cn=<the_group_cn>))'. Status: 1 entries.][][Ldap Search callout succeeds.][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][]
But the Policy Server doesn't find the user as this group member:
[09/11/2023][16:55:06.247][16:55:06][2139565][140124306269952][SmDsLdapProvider.cpp:2685][CSmDsLdapProvider::SearchCount][][][][][][][][][][][][][][][][][][][(SearchCount) Base: 'exampleguid=<xxxx>,o=groups,dc=example,dc=com', Filter: 'member=exampleguid=<name2>,o=<specific_group>,dc=example,dc=com'. Status: 0 entries][][Ldap SearchCount callout succeeds.][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][]
The issue can be worked around by removing groupOfNames object classes from the LDAP group.
Policy Server 12.8SP7 on RedHat 7;
User Store on LDAP Oracle Unified Directory 12.2.1.4.221009;
Looking the LDAP configuration, the group
exampleguid=<xxxx>,o=groups,dc=example,dc=com
has 2 objectclasses:
groupOfNames
groupOfUniqueNames
Each of them should have its attribute:
| ObjectClass | Attribute |
|--------------------+--------------|
| groupOfNames | member |
| groupOfUniqueNames | uniqueMember |
When looking at the group config, only the attribute "uniqueMember" for groupOfUniqueNames is configured:
# <xxxx>, groups, example.com
dn: exampleguid=<xxxx>,o=groups,dc=example,dc=com
uniqueMember: exampleguid=<name2>,o=<specific_group>,dc=example,dc=com
cn: <the_group_cn>
description: The group
objectClass: groupOfUniqueNames
objectClass: groupOfNames
objectClass: top
objectClass: exampleGroupOfNames
exampleguid: <xxxx>
Both attributes are mandatory should be set as per RFC 4519 (1).
In the LDAP group:
exampleguid=<xxxx>,o=groups,dc=example,dc=com
add the attribute
member=exampleguid=<name2>,o=<specific_group>,dc=example,dc=com
to solve this issue.