Sun Java System Directory Server Enterprise Edition 6.2 Administration Guide

Managing Groups

Groups enable you to associate entries for ease of administration. For example, using groups makes it easier to define access control instructions (ACIs). Group definitions are special entries that either name their members in a static list or provide a filter that defines a dynamic set of entries.

The scope of possible members of a group is the entire directory, regardless of where the group definition entries are located. To simplify administration, all group definition entries are usually stored in a single location, usually ou=Groups under the root suffix.

The two types of groups are static groups and dynamic groups.

ProcedureTo Create a New Static Group

You cannot use DSCC to perform this task. Use the command line, as described in this procedure.

  1. Create a new static group using the ldapmodify command.

    For example, to create a new static group called System Administrators and to add some members, you could use this command:


    $ ldapmodify -a -h host1 -p 1389 -D cn=admin,cn=Administrators,cn=config -w -
    dn: cn=System Administrators, ou=Groups, dc=example,dc=com
    changetype: add
    cn: System Administrators
    objectclass: top
    objectclass: groupOfNames
    ou: Groups
    member: uid=kvaughan, ou=People, dc=example,dc=com
    member: uid=rdaugherty, ou=People, dc=example,dc=com
    member: uid=hmiller, ou=People, dc=example,dc=com
  2. Check to see that the new group has been created and that the members have been added.

    For example, to check that Kirsten Vaughan is in the new System Administrators group, type:


    $ ldapsearch -b "dc=example,dc=com" uid=kvaughan isMemberOf
    uid=kvaughan,ou=People,dc=example,dc=com
    isMemberOf: cn=System Administrators, ou=Groups, dc=example,dc=com 
    isMemberOf: cn=HR Managers,ou=groups,dc=example,dc=com

ProcedureTo Create a New Dynamic Group

You cannot use DSCC to perform this task. Use the command line, as described in this procedure.

  1. Create a new dynamic group by using the ldapmodify command.

    For example, to create a new dynamic group called “3rd Floor”, which includes all employees whose room numbers start with 3, you could use this command:


    $ ldapmodify -a -h host1 -p 1389 -D cn=admin,cn=Administrators,cn=config -w -
    dn: cn=3rd Floor, ou=Groups, dc=example,dc=com
    changetype: add
    cn: 3rd Floor
    objectclass: top
    objectclass: groupOfUrls
    ou: Groups
    memberURL: ldap:///dc=example,dc=com??sub?(roomnumber=3*)