Managing Groups

Groups enable you to associate entries for ease of administration. For example, using groups makes it easier to define access control instructions (ACIs). Group definitions are special entries that either name their members in a static list or provide a filter that defines a dynamic set of entries.

The scope of possible members of a group is the entire directory, regardless of where the group definition entries are located. To simplify administration, all group definition entries are usually stored in a single location, usually ou=Groups under the root suffix.

The two types of groups are static groups and dynamic groups.

• Static groups. The entry that defines a static group inherits from either the groupOfNames or groupOfUniqueNames object class. Group members are listed by their DN as multiple values of the member or uniqueMember attribute.

  Alternatively, you can use the isMemberOf attribute for static groups. The isMemberOf attribute is calculated and added to the user entry at the start of the search. It is then removed again after the search has finished. This functionality provides easy management of groups, and fast read access.

• Dynamic groups. The entry that defines a dynamic group inherits from the groupOfURLs object class. Group membership is defined by one or more filters that are specified in the multivalued memberURL attribute. The members in a dynamic group are the entries that match any one of the filters whenever the filters are evaluated.

To Create a New Static Group

You cannot use DSCC to perform this task. Use the command line, as described in this procedure.

1. Create a new static group using the ldapmodify command.

   For example, to create a new static group called System Administrators and to add some members, you could use this command:

   $ ldapmodify -a -h host1 -p 1389 -D cn=admin,cn=Administrators,cn=config -w -
   dn: cn=System Administrators, ou=Groups, dc=example,dc=com
   changetype: add
   cn: System Administrators
   objectclass: top
   objectclass: groupOfNames
   ou: Groups
   member: uid=kvaughan, ou=People, dc=example,dc=com
   member: uid=rdaugherty, ou=People, dc=example,dc=com
   member: uid=hmiller, ou=People, dc=example,dc=com

2. Check to see that the new group has been created and that the members have been added.

   For example, to check that Kirsten Vaughan is in the new System Administrators group, type:

   $ ldapsearch -b "dc=example,dc=com" uid=kvaughan isMemberOf
   uid=kvaughan,ou=People,dc=example,dc=com
   isMemberOf: cn=System Administrators, ou=Groups, dc=example,dc=com 
   isMemberOf: cn=HR Managers,ou=groups,dc=example,dc=com

To Create a New Dynamic Group

You cannot use DSCC to perform this task. Use the command line, as described in this procedure.

• Create a new dynamic group by using the ldapmodify command.

  For example, to create a new dynamic group called “3rd Floor”, which includes all employees whose room numbers start with 3, you could use this command:

  $ ldapmodify -a -h host1 -p 1389 -D cn=admin,cn=Administrators,cn=config -w -
  dn: cn=3rd Floor, ou=Groups, dc=example,dc=com
  changetype: add
  cn: 3rd Floor
  objectclass: top
  objectclass: groupOfUrls
  ou: Groups
  memberURL: ldap:///dc=example,dc=com??sub?(roomnumber=3*)