Novell EDIRECTORY 8.8 - GUIDE, Manual, Page: 33 / 574

Understanding Novell eDirectory 33
no
vd
ocx (
E
NU)
01
F
ebr
ua
ry
200
6
group members in terms of a logical grouping and lets eDirectory automatically add and remove
group members. This solution is more scalable, reduces administrative costs, and can supplement
normal groups in LDAP to provide increased flexibility.
eDirectory lets you create a dynamic group when you want to automatically group users based on
any attribute, or when you want to apply ACLs to specific groups that contain matching DNs. For
example, you can create a group that automatically includes any DN that contains the attribute
Department=Marketing. If you apply a search filter for Department=Marketing, the search returns a
group including all DNs containing the attribute Department=Marketing. You can then define a
dynamic group from the search results based on this filter. Any User added to the directory who
matches the Department=Marketing criteria is automatically added to the group. Any User whose
Department is changed to another value (or who is removed from the directory) is automatically
removed from the group.
Dynamic groups are created in eDirectory by creating an object of type objectclass=dynamicGroup.
A static Group object can be converted into a dynamic group by associating an auxiliary class,
dynamicGroupAux, to the Group object. The dynamic group has the memberQueryURL attribute
associated with it.
A dgIdentity attribute can be set on the Dynamic Group object to the distinguished name of an entry,
whose credentials and rights should be used to expand the dynamic members of the group.
The groups are managed using the memberQueryURL. A typical memberQueryURL has a base DN,
a scope, a filter, and an optional extension. The base DN specifies the search base. Scope specifies
the levels below the base to search, and filter is the search filter based on which entries are selected
from within the specified scope.
NOTE: To address exceptions to the listing created by the memberQueryURL, dynamic groups also
allow for explicit inclusion and exclusion of users.
Dynamic groups can be created and managed through Novell iManager. You can access the
Dynamic Group management tasks by clicking the
Dynamic Groups role on the Roles and Tasks
page.
You can also use LDAP commands to manage such groups. The most useful properties associated
with dynamic groups are dgIdentity and memberQueryURL.
Important Properties
The most useful properties of the Group object are Members and Rights to Files and Directories. For
a complete list of properties, select a Group object in iManager. To display a description for each
page of properties, click
Help .
• dgAllowDuplicates
Specifies whether or not duplicates are allowed while printing dynamic group members. The
default is TRUE.
• dgIdentity
This property holds the DN whose identity the dynamic group will use for authentication while
searching. The identity must be on the same partition as the dynamic group. The object
specified by dgldentity should have the necessary rights to do the search specified in the
memberQueryURL attribute.
For example, if memberQueryURL value is