How to Configure Ubuntu Server OpenLDAP with memberOf Overlay for Reverse Group Membership Resolution

OpenLDAP is the cornerstone of open-source directory services and centralized authentication on Ubuntu Server. However, legacy applications interacting with the LDAP database often struggle with group membership queries. By default, OpenLDAP stores group memberships in a forward direction: the group entry (groupOfNames) contains a list of member attributes pointing to specific users. If an application needs to know “Which groups does User A belong to?”, it must perform an expensive, tree-wide search across every group in the directory. To optimize these reverse lookups and ensure compatibility with modern SSO gateways like Keycloak or Authelia, Ubuntu administrators must configure the memberOf dynamic overlay.

The Mechanics of the memberOf Overlay

The memberOf overlay is a dynamic module that intercepts LDAP modification requests. When an administrator adds a user’s Distinguished Name (DN) to a group’s member attribute, the overlay silently intercepts the write operation and automatically injects a reverse memberOf attribute directly into the user’s object.

Consequently, when an application queries the user object, it instantly receives a list of every group the user belongs to without needing to scan the rest of the directory tree. Because this attribute is generated dynamically by the overlay, it cannot be modified directly by clients; it is strictly read-only and always perfectly synchronized with the actual group objects.

Loading the memberOf Module

On modern Ubuntu Server deployments, OpenLDAP (slapd) utilizes the dynamic cn=config configuration engine (OLC) rather than the legacy slapd.conf flat file. You must use LDIF (LDAP Data Interchange Format) files to inject the module.

First, create an LDIF file to load the memberof.la module into the kernel.

# load_module.ldif
dn: cn=module{0},cn=config
changetype: modify
add: olcModuleLoad
olcModuleLoad: memberof.la

Execute the LDIF file against the local configuration tree using the root UNIX socket:

sudo ldapmodify -Y EXTERNAL -H ldapi:/// -f load_module.ldif

Applying the Overlay to the Database

Once the module is loaded, you must bind it to your specific directory database (typically olcDatabase={1}mdb). Create a second LDIF file to configure the overlay parameters.

# configure_overlay.ldif
dn: olcOverlay=memberof,olcDatabase={1}mdb,cn=config
changetype: add
objectClass: olcConfig
objectClass: olcMemberOf
objectClass: olcOverlayConfig
objectClass: top
olcOverlay: memberof
olcMemberOfDangling: ignore
olcMemberOfRefInt: TRUE
olcMemberOfGroupOC: groupOfNames
olcMemberOfMemberAD: member
olcMemberOfMemberOfAD: memberOf

This configuration defines the mapping rules. It instructs the overlay to watch any object with the groupOfNames objectClass. When the member attribute is updated, it automatically populates the memberOf attribute on the target user. Apply the configuration:

sudo ldapmodify -Y EXTERNAL -H ldapi:/// -f configure_overlay.ldif

Refint: Maintaining Referential Integrity

A critical issue arises when a user account is completely deleted from the directory. While the user is gone, their DN remains orphaned as a “dangling reference” inside the member attribute of any groups they previously belonged to. To resolve this, you must also enable the Referential Integrity (refint) overlay.

Create a final LDIF file to load and configure the refint module:

# configure_refint.ldif
dn: cn=module{0},cn=config
changetype: modify
add: olcModuleLoad
olcModuleLoad: refint.la

dn: olcOverlay=refint,olcDatabase={1}mdb,cn=config
changetype: add
objectClass: olcConfig
objectClass: olcOverlayConfig
objectClass: olcRefintConfig
objectClass: top
olcOverlay: refint
olcRefintAttribute: membermanager secmod

Apply the file:

sudo ldapmodify -Y EXTERNAL -H ldapi:/// -f configure_refint.ldif

With both overlays active, your Ubuntu OpenLDAP server is completely self-maintaining. It instantly provides reverse group lookups for rapid authentication queries, and automatically scrubs orphaned data when directory objects are permanently purged.