vault (v0.5.2) patch that allows for OpenLDAP posixGroup memberUid to be specified by `userdn` in addition to `username` attributes.

vault-v0.5.2-ldap-posixgroup.patch

From dce80eca05c62f3f7ec3f459f1e4ca6c6e243706 Mon Sep 17 00:00:00 2001
From: Anthony O'Brien <asobrien@jwplayer.com>
Date: Mon, 9 May 2016 12:16:19 -0400
Subject: [PATCH] Allow non-complaint posixGroup search that matches
 GroupOfNames

---
 builtin/credential/ldap/backend.go | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/builtin/credential/ldap/backend.go b/builtin/credential/ldap/backend.go
index 603d5cd..936b373 100644
--- a/builtin/credential/ldap/backend.go
+++ b/builtin/credential/ldap/backend.go
@@ -149,7 +149,8 @@ func (b *backend) Login(req *logical.Request, username string, password string)
 	sresult, err := c.Search(&ldap.SearchRequest{
 		BaseDN: cfg.GroupDN,
 		Scope:  2, // subtree
-		Filter: fmt.Sprintf("(|(memberUid=%s)(member=%s)(uniqueMember=%s))", ldap.EscapeFilter(username), ldap.EscapeFilter(userdn), ldap.EscapeFilter(userdn)),
+		// we're not openLDAP complaint, patch it to allow matching of userdn in memberUid field
+		Filter: fmt.Sprintf("(|(memberUid=%s)(memberUid=%s)(member=%s)(uniqueMember=%s))", ldap.EscapeFilter(userdn), ldap.EscapeFilter(username), ldap.EscapeFilter(userdn), ldap.EscapeFilter(userdn)),
 	})
 	if err != nil {
 		return nil, logical.ErrorResponse(fmt.Sprintf("LDAP search failed: %v", err)), nil
-- 
2.7.1