SLAPO-NESTGROUP(5)

✨ slapo-nestgroup — the Nested Group overlay for slapd ✨

okay bestie, so this is a File Formats Manual page, and it's all about slapo-nestgroup(5) — the overlay that makes nested groups actually work in your directory. it's giving "found family but for LDAP groups" 💖 and honestly? iconic.

---

📖 SYNOPSIS

/etc/openldap/slapd.conf

---

🌸 DESCRIPTION

so the nestgroup overlay plugs into slapd(8) and lets it evaluate nested groups during Search operations. like, groups inside groups inside groups. no cap.

the support is made of four possible features:

• inclusion of parent groups when you're searching with (member=) filters
• inclusion of child groups when you're searching with (memberOf=) filters
• expansion of child groups when returning member attributes
• expansion of parent groups when returning memberOf attributes

each one of these can be switched on independently, bestie — mix and match however you want. but here's the thing: by default no features are enabled, so this overlay literally does nothing unless you explicitly turn stuff on. it's a no-op until you give it a reason to exist. main character energy requires activation 💅

---

🎀 CONFIGURATION

all the config directives that belong specifically to nestgroup have to be prefixed with nestgroup-. that's so they don't start drama with directives owned by the underlying database or by other stacked overlays. polite queen behavior 🫶

• overlay nestgroup — this adds the nestgroup overlay to the current database; peep slapd.conf(5) for the details.

---

the slapd.conf options, bestie

the following configuration options are defined for the nestgroup overlay 💜

• nestgroup-member <member-ad> — the value of <member-ad> is the name of the attribute that holds the names of the members on the group objects; it must be DN-valued. defaults to member.
• nestgroup-memberof <memberof-ad> — the value of <memberof-ad> is the name of the attribute that holds the names of the groups an entry is a member of; it must be DN-valued. defaults to memberOf.
• nestgroup-base <dn> — the value of <dn> names a subtree inside the DIT that contains group entries. you can hand this option over multiple times for multiple distinct subtrees, and it's fully valid to do so. it has no default, and the overlay does no processing whatsoever unless it's explicitly configured. so if you skip this one, nothing happens. at all. 🙈
• nestgroup-flags {member-filter, memberof-filter, member-values, memberof-values} — this one tells the overlay which features to enable. by default, nothing is enabled and the overlay is a complete no-op.

💀 real talk: this overlay may be used with any backend that provides standard search functionality.

---

🗂️ FILES

• /etc/openldap/slapd.conf — the default slapd configuration file 🍓

---

👀 SEE ALSO

slapo-dynlist(5), slapo-memberof(5), slapd.conf(5), slapd-config(5), slapd(8).

also!! the slapo-nestgroup(5) overlay supports dynamic configuration via back-config. so you can configure it on the fly, iykyk ✨

---

💐 ACKNOWLEDGEMENTS

this module was written in 2024 by Howard Chu of Symas Corporation. respect the legend 👑

---

okay that's the whole page bestie, go forth and nest those groups 🌈🦋

this gem is from OpenLDAP 2.7.2, dated 2026/10/21 — periodt 💅