# Freeipa ldap group problem
**URL:** https://forums.suse.com/t/freeipa-ldap-group-problem/14412
**Category:** SUSE Rancher Prime
**Created:** [May 29, 2019, 3:49pm UTC](https://forums.suse.com/t/freeipa-ldap-group-problem/14412 "2019-05-29T15:49:38Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@Markus\_Frohlich](https://forums.suse.com/u/Markus_Frohlich)
#### Post date: [May 29, 2019, 3:49pm UTC](https://forums.suse.com/t/freeipa-ldap-group-problem/14412/1 "2019-05-29T15:49:38Z")
rancher v2.2.3
FreeIPA, Version: 4.7.90
LDIF data of freeipa (shortened to relevant attributes):
- user example
dn: uid=fmax.test,cn=users,cn=accounts,dc=domain,dc=com
uid: fmax.test
cn: fmax test
objectClass: person
objectClass: organizationalperson
objectClass: inetorgperson
objectClass: inetuser
objectClass: posixaccount
memberOf: cn=ipausers,cn=groups,cn=accounts,dc=domain,dc=com
memberOf: cn=developers,cn=groups,cn=accounts,dc=domain,dc=com
memberOf: cn=testgruppe1,cn=groups,cn=accounts,dc=domain,dc=com
- group example
dn: cn=developers,cn=groups,cn=accounts,dc=domain,dc=com
objectClass: posixgroup
objectClass: nestedgroup
objectClass: groupofnames
cn: developers
member: uid=fmax.test,cn=users,cn=accounts,dc=domain,dc=com
enabled debug for rancher: [https://rancher.com/docs/rancher/v2.5/en/faq/technical/](https://rancher.com/docs/rancher/v2.x/en/faq/technical/#how-can-i-enable-debug-logging)
site access setting: Allow members of Clusters, Projects, plus Authorized Users and Organizations
**developers** (searching for groups is working)
when i try to login with user _fmax.test_ which is member of group _developers_ it doesn’t work.
in the logs you could see the search result and users group query:
2019/05/29 15:36:44 [DEBUG] SearchResult memberOf attribute {[cn=ipausers,cn=groups,cn=accounts,dc=domain,dc=com cn=developers,cn=groups,cn=accounts,dc=domain,dc=com]}
2019/05/29 15:36:44 [DEBUG] Ldap: Query for pulling user’s groups: (&(objectClass=groupofnames)(|(entrydn=cn=ipausers,cn=groups,cn=accounts,dc=domain,dc=com)(entrydn=cn=developers,cn=groups,cn=accounts,dc=domain,dc=com)))
and that seems to be the problem.
that’s with default settings of gui menu **customize schema**
i did a lot of tries with different ldap attributes, but didn’t get it working.
changing attribute for _Group DN Attribute_ also changes the debug output - example: member.
so you get logs with _Ldap: Query for pulling user’s groups: (&(objectClass=groupofnames)(|(member=cn=ipausers,cn=groups,cn=accounts,dc=domain,dc=com)(member=cn=developers,cn=groups,cn=accounts,dc=domain,dc=com)))_
but i think this should get to use the users DN instead of group DN:
_member=uid=fmax.test,cn=users,cn=accounts,dc=domain,dc=com_
i also tried to set _user search base_ to _cn=accounts,dc=domain,dc=com_ and _cn=users,cn=accounts,dc=domain,dc=com_
also with group search base let empty or set to _cn=groups,cn=accounts,dc=domain,dc=com_
sadly nothing does work as expected.
has someone a working setup with rancher v2.2.3 and could tell me please?
---
### Author:  [@limz8319](https://forums.suse.com/u/limz8319)
#### Post date: [March 13, 2020, 1:57pm UTC](https://forums.suse.com/t/freeipa-ldap-group-problem/14412/2 "2020-03-13T13:57:03Z")
I have the same problem as you, have you solved it?
---
### Author:  [@gy8409](https://forums.suse.com/u/gy8409)
#### Post date: [February 21, 2022, 4:34am UTC](https://forums.suse.com/t/freeipa-ldap-group-problem/14412/3 "2022-02-21T04:34:32Z")
I have the same problem. Rancher version is v2.5.8