Starting and Stopping Your Server Instance
Configuring the Server Instance
Configuring the Proxy Components
Configuring Security Between Clients and Servers
Configuring Security Between the Proxy and the Data Source
Configuring Servers With the Control Panel
Managing Root User, Global Administrator, and Administrator Accounts
Working With Multiple Root Users
Root Users and the Privilege Subsystem
Managing Root Users With dsconfig
To View the Default Root User Privileges
To Edit the Default Root User Privileges
To Change a Root User's Password
To Change a Root User's Privileges
Setting Root User Resource Limits
Managing Global Administrators
To Create an Administrator with Root User Privileges
Password Policies in a Replicated Environment
To View the List of Password Policies
Properties of the Default Password Policy
To View the Properties of the Default Password Policy
To Create a New Password Policy
To Create a First Login Password Policy
To Assign a Password Policy to an Individual Account
To Prevent Password Policy Modifications
To Assign a Password Policy to a Group of Users
To Change the Directory Manager's Password
To Reset and Generate a New Password for a User
Managing a User's Account Information
To View a User's Account Information
To View Account Status Information
Setting Resource Limits on a User Account
To Set Resource Limits on an Account
To Create a Static Group With groupOfNames
To Create a Static Group With groupOfUniqueNames
To Create a Static Group With groupOfEntries
To List All Members of a Static Group
To List All Members of a Dynamic Group
To List All Dynamic Groups of Which a User Is a Member
To Determine Whether a User Is a Member of a Dynamic Group
Defining Virtual Static Groups
To Create a Virtual Static Group
To List All Members of a Virtual Static Group
To List All Virtual-Static Groups of Which a User Is a Member
To Determine Whether a User is a Member of a Virtual Static Group
Maintaining Referential Integrity
Overview of the Referential Integrity Plug-In
To Enable the Referential Integrity Plug-In
Simulating DSEE Roles in an OpenDS Directory Server
To Determine Whether a User is a Member of a Role
To Alter Membership by Using the nsRoleDN Attribute
A static group is one whose entry contains a membership list of explicit DNs. Many clients support static groups, but static groups are difficult to manage as the number of members in a group increases in size. For example, if you have a member entry that requires a DN change, then you must change the user's DN for each group she belongs to.
Because a static group contains a list of explicit member DNs, its database footprint increases as the membership list grows. For this reason, a static group is best suited for small groups (less than 10,000) whose entries do not change frequently. Using large static groups can have a detrimental impact on performance. If you know that group membership will exceed 10,000, consider using dynamic groups instead.
The directory server supports the following three types of static groups, divided according to the object class they use:
groupOfNames You can define a static group by using the groupOfNames object class and by explicitly specifying the member DNs using the member attribute.
Note - RFC 4519 requires that the member attribute be mandatory within the groupOfNames object class. This membership requirement has traditionally caused data management problems when an administrator attempted to delete the last member in the group. The directory server solves this problem by allowing the member attribute to be optional. The optional membership requirement allows you to have an empty object class when you delete the last member of the group.
dn: cn=Example Static Group 1,ou=Groups,dc=example,dc=com objectClass: top objectClass: groupOfNames member: uid=user1,ou=People,dc=example,dc=com member: uid=user2,ou=People,dc=example,dc=com cn: Example Static Group 1
groupOfUniqueNames You can define a static group by using the groupOfUniqueNames object class and by explicitly specifying the member DNs using the uniqueMember attribute. The groupOfUniqueNames object class differs from the groupOfNames object class in that you can enumerate the group's members by specifying a unique DN plus an optional identifier. The identifier ensures that the unique objects can be identified when adding, deleting, or renaming any object.
For example, you could delete or move an employee (cn=Tom Smith) and add a new employee who has the same name (cn=Tom Smith) to the directory. To distinguish the two, you must add a separate identifier by using a bit string. The following example shows two users with the same name, but the second uniqueMember has an optional identifier.
uniqueMember: uid=tsmith,ou=People,dc=example,dc=com uniqueMember: uid=tsmith,ou=People,dc=example,dc=com#'0111101'B
Note - Few LDAP applications actually use the optional UID identifier.
RFC 4519 requires that the uniqueMember attribute be mandatory within the groupOfUniqueNames object class. This membership requirement has historically caused data management problems when an administrator tried to delete the last member in the group. The directory server solves this problem by allowing the uniqueMember attribute to be optional. The optional membership requirement allows you to have an empty object class when you delete the last member of the group.
dn: cn=Example Static Group 2,ou=Groups,dc=example,dc=com objectClass: top objectClass: groupOfUniqueNames uniqueMember: uid=user1,ou=People,dc=example,dc=com uniqueMember: uid=user2,ou=People,dc=example,dc=com cn: Example Static Group 2
groupOfEntries You can define a static group using the groupOfEntries object class. Based on the original specifications ( RFC 4519 and draft-findlay-ldap-grouofentries-00.txt, which expired in March, 2008), the groupOfEntries object class differs from the groupOfNames and groupOfUniqueNames object classes in that attributes are optional. This allows you to specify an empty object class without any members.
Note - The directory server supports the groupOfEntries draft but also allows empty groupOfNames and groupOfUniqueNames object classes. As a result, you can create empty groups of any type (groupOfEntries, groupOfNames, and groupOfUniqueNames).
dn: cn=Example Static Group 3,ou=Groups,dc=example,dc=com objectClass: top objectClass: groupOfEntries cn: Example Static Group 3
This example shows an LDIF file, named static-group1.ldif, that defines the new group.
dn: cn=Directory Administrators,ou=Groups,dc=example,dc=com cn: Directory Administrators objectclass: top objectclass: groupOfNames ou: Groups member: uid=ttully,ou=People,dc=example,dc=com member: uid=charvey,ou=People,dc=example,dc=com member: uid=rfisher,ou=People,dc=example,dc=com
$ ldapmodify -h localhost -p 1389 -D "cn=Directory Manager" -w password \ --defaultAdd --filename static-group1.ldif Processing ADD request for cn=Directory Administrators,ou=Groups,dc=example,dc=com ADD operation successful for DN cn=Directory Administrators,ou=Groups,dc=example,dc=com
This example shows an LDIF file, named static-group2.ldif, that defines the new group.
dn: cn=Directory Administrators2,ou=Groups,dc=example,dc=com cn: Directory Administrators2 objectclass: top objectclass: groupOfUniqueNames ou: Groups uniquemember: uid=alangdon,ou=People,dc=example,dc=com uniquemember: uid=drose,ou=People,dc=example,dc=com uniquemember: uid=polfield,ou=People,dc=example,dc=com
$ ldapmodify -h localhost -p 1389 -D "cn=Directory Manager" -w password \ --defaultAdd --filename static-group2.ldif
$ ldapsearch -h localhost -p 1389 -D "cn=Directory Manager" -w password \ --baseDN dc=example,dc=com "(uid=rdaugherty)" isMemberOf dn: uid=alangdon,ou=People,dc=example,dc=com isMemberOf: cn=Directory Administrators2,ou=Groups,dc=example,dc=com
This example shows an LDIF file, named static-group3.ldif, that defines the new group.
dn: cn=Directory Administrators3,ou=Groups,dc=example,dc=com cn: Directory Administrators3 objectclass: top objectclass: groupOfEntries ou: Groups member: uid=bfrancis,ou=People,dc=example,dc=com member: uid=tjames,ou=People,dc=example,dc=com member: uid=bparker,ou=People,dc=example,dc=com
$ ldapmodify -h localhost -p 1389 -D "cn=Directory Manager" -w password \ --defaultAdd --filename static-group3.ldif
$ ldapsearch -h localhost -p 1389 -D "cn=Directory Manager" -w password \ --baseDN dc=example,dc=com "(uid=bparker)" isMemberOf dn: uid=bparker,ou=People,dc=example,dc=com isMemberOf: cn=Directory Administrators3,ou=Groups,dc=example,dc=com
You can use the isMemberOf virtual attribute to search for a group. The attribute is added to the user entry at the start of the search and then removed after the search has finished. This functionality provides easy management of groups with fast read access.
This example searches for all users who are members of the group “Accounting Managers”.
$ ldapsearch -h localhost -p 1389 -D "cn=Directory Manager" -w password \ -b dc=example,dc=com \ "(isMemberOf=cn=Accounting Managers,ou=Groups,dc=example,dc=com)" dn: uid=scarter,ou=People,dc=example,dc=com objectClass: person objectClass: inetOrgPerson objectClass: top objectClass: organizationalPerson ou: Accounting ou: People sn: Carter facsimiletelephonenumber: +1 408 555 9751 roomnumber: 4612 userpassword: {SSHA}3KiJ51sx2Ug7DxZoq0vA9ZY6uaomevbJUBm7OA== l: Sunnyvale cn: Sam Carter telephonenumber: +1 408 555 4798 givenname: Sam uid: scarter mail: scarter@example.com dn: uid=tmorris,ou=People,dc=example,dc=com objectClass: person objectClass: inetOrgPerson objectClass: top objectClass: organizationalPerson ou: Accounting ou: People sn: Morris facsimiletelephonenumber: +1 408 555 8473 roomnumber: 4117 userpassword: {SSHA}bjFFHv6k1kbI6fZoCEfqmTj9XOZxWR06gxpKpQ== l: Santa Clara cn: Ted Morris telephonenumber: +1 408 555 9187 givenname: Ted uid: tmorris mail: tmorris@example.com
$ ldapsearch -h localhost -p 1389 -D "cn=Directory Manager" -w password \ -b dc=example,dc=com "(uid=scarter)" isMemberOf dn: uid=scarter,ou=People,dc=example,dc=com isMemberOf: cn=Accounting Managers,ou=groups,dc=example,dc=com
$ ldapsearch -h localhost -p 1389 -D "cn=Directory Manager" -w password \ -b "cn=Account Managers,ou=Groups,dc=example,dc=com" \ "(&(objectclass=groupOfUniqueNames) \ (uniquemember=uid=scarter,ou=People,dc=example,dc=com))" dn: cn=Accounting Managers,ou=groups,dc=example,dc=com objectClass: groupOfUniqueNames objectClass: top ou: groups description: People who can manage accounting entries cn: Accounting Managers uniquemember: uid=scarter, ou=People, dc=example,dc=com uniquemember: uid=tmorris, ou=People, dc=example,dc=com