我正在尝试在LDAP中使用对象类inetOrgPerson和groupOfNames来创build一个用户（所以我可以使用属性'member'），但是不pipe我尝试哪种组合，它都不会让我。 什么是使用“成员”属性的正确方法？
这是我尝试通过Apache Directory Studio添加它时得到的错误消息。
Error while creating entry - [LDAP: error code 65 - OBJECT_CLASS_VIOLATION: failed for MessageType : ADD_REQUES java.lang.Exception: [LDAP: error code 65 - OBJECT_CLASS_VIOLATION: failed for MessageType : ADD_REQUEST Message ID : 113 Add Request : Entry dn[n]: [email protected],o=test,ou=tenant,dc=test,dc=com objectClass: groupOfNames objectClass: organizationalPerson objectClass: person objectClass: top objectClass: inetOrgPerson uid: [email protected] member: cn=user,ou=role,dc=test,dc=com sn: sadsadsad cn: sdsadsad : ERR_61 Entry [email protected],o=test,ou=tenant,dc=test,dc=com contains more than one STRUCTURAL ObjectClass: [OBJECT_CLASS ( 2.5.6.9 NAME 'groupOfNames' DESC RFC2256: a group of names (DNs) SUP 'top' STRUCTURAL MUST ( 'cn' $ 'member' ) MAY ( 'businessCategory' $ 'seeAlso' $ 'owner' $ 'ou' $ 'o' $ 'description' ) ) , OBJECT_CLASS ( 2.16.840.1.113730.3.2.2 NAME 'inetOrgPerson' DESC RFC2798: Internet Organizational Person SUP 'organizationalPerson' STRUCTURAL MAY ( 'audio' $ 'businessCategory' $ 'carLicense' $ 'departmentNumber' $ 'displayName' $ 'employeeNumber' $ 'employeeType' $ 'givenName' $ 'homePhone' $ 'homePostalAddress' $ 'initials' $ 'jpegPhoto' $ 'labeledURI' $ 'mail' $ 'manager' $ 'mobile' $ 'o' $ 'pager' $ 'photo' $ 'roomNumber' $ 'secretary' $ 'uid' $ 'userCertificate' $ 'x500UniqueIdentifier' $ 'preferredLanguage' $ 'userSMIMECertificate' $ 'userPKCS12' ) ) ]] at org.apache.directory.studio.connection.core.io.api.DirectoryApiConnectionWrapper.checkResponse(DirectoryApiConnectionWrapper.java:1280) at org.apache.directory.studio.connection.core.io.api.DirectoryApiConnectionWrapper.access$600(DirectoryApiConnectionWrapper.java:109) at org.apache.directory.studio.connection.core.io.api.DirectoryApiConnectionWrapper$6.run(DirectoryApiConnectionWrapper.java:928) at org.apache.directory.studio.connection.core.io.api.DirectoryApiConnectionWrapper.runAndMonitor(DirectoryApiConnectionWrapper.java:1175) at org.apache.directory.studio.connection.core.io.api.DirectoryApiConnectionWrapper.checkConnectionAndRunAndMonitor(DirectoryApiConnectionWrapper.java:1109) at org.apache.directory.studio.connection.core.io.api.DirectoryApiConnectionWrapper.createEntry(DirectoryApiConnectionWrapper.java:950) at org.apache.directory.studio.ldapbrowser.core.jobs.CreateEntryRunnable.createEntry(CreateEntryRunnable.java:224) at org.apache.directory.studio.ldapbrowser.core.jobs.CreateEntryRunnable.run(CreateEntryRunnable.java:124) at org.apache.directory.studio.connection.ui.RunnableContextRunner$1.run(RunnableContextRunner.java:112) at org.eclipse.jface.operation.ModalContext$ModalContextThread.run(ModalContext.java:121) [LDAP: error code 65 - OBJECT_CLASS_VIOLATION: failed for MessageType : ADD_REQUEST Message ID : 113 Add Request : Entry dn[n]: [email protected],o=test,ou=tenant,dc=test,dc=com objectClass: groupOfNames objectClass: organizationalPerson objectClass: person objectClass: top objectClass: inetOrgPerson uid: [email protected] member: cn=user,ou=role,dc=test,dc=com sn: sadsadsad cn: sdsadsad : ERR_61 Entry [email protected],o=test,ou=tenant,dc=test,dc=com contains more than one STRUCTURAL ObjectClass: [OBJECT_CLASS ( 2.5.6.9 NAME 'groupOfNames' DESC RFC2256: a group of names (DNs) SUP 'top' STRUCTURAL MUST ( 'cn' $ 'member' ) MAY ( 'businessCategory' $ 'seeAlso' $ 'owner' $ 'ou' $ 'o' $ 'description' ) ) , OBJECT_CLASS ( 2.16.840.1.113730.3.2.2 NAME 'inetOrgPerson' DESC RFC2798: Internet Organizational Person SUP 'organizationalPerson' STRUCTURAL MAY ( 'audio' $ 'businessCategory' $ 'carLicense' $ 'departmentNumber' $ 'displayName' $ 'employeeNumber' $ 'employeeType' $ 'givenName' $ 'homePhone' $ 'homePostalAddress' $ 'initials' $ 'jpegPhoto' $ 'labeledURI' $ 'mail' $ 'manager' $ 'mobile' $ 'o' $ 'pager' $ 'photo' $ 'roomNumber' $ 'secretary' $ 'uid' $ 'userCertificate' $ 'x500UniqueIdentifier' $ 'preferredLanguage' $ 'userSMIMECertificate' $ 'userPKCS12' ) ) ]] 技术原因是groupOfNames和person objectClass是相互排斥的。 他们都是结构类，但没有从属关系，使他们不同的objectClass链，并根据RFC 4512 ：
对象或别名条目的特征正是一个结构对象类超类链，其具有单个结构对象类作为最下级对象类。
一个组有成员，但是一个人不是一个组，也不能有一个组。
据我所知，通常你使一个人成为一个组的成员，LDAP服务器提供了一个内部函数来维护反向查找映射，以便轻松检索一个对象所属的组，一个虚拟属性（如果你愿意的话），通常是memberOf属性。 ApacheDS可能不支持这个（ 还 ）。
换句话说，LDAP对象所属的组不是对象本身的属性，您应该甚至不需要尝试手动维护。