Does OpenLDAP supports inheritance?

Question

I have OU=people and 4 other groups like apple,mango,grape,orange. Now if i do OU=people is a member of CN=apple.

can OU=people users will get same privileges as like CN=apple ? I know little about Active directory LDAP service. There inheritance is possible. What about in OpenLDAP ? can i do OU=people is a memberof all 4 groups ?

Thanks

Answer 1

The type of automatic inheritance you're talking about isn't built-in to OpenLDAP but there are two options you could use instead:

• ACL sets, which give a very powerful way to define access rules. Also see here
• Dynamic Groups, using the memberURL attribute and either the DynGroup or DynList overlay