Novell EDIRECTORY 8.8 - GUIDE, Manual

Page: 34 / 574

34 Novell eDirectory 8.8 Administration Guide
no
vd
ocx (
E
NU)
01
F
ebr
ua
ry
200
6
“ldap:///o=nov??sub?(title=*)”
then dgldentity should have read/compare rights on the attribute title below the container
o=nov.
• dgTimeout
This property specifies the maximum duration a server can take to read or compare a member
attribute before it times out. When the server exceeds this dgTimeout value, the -6016 error is
displayed.
• memberQueryURL
This property defines the set of rules that match with the attributes of the group members.
memberQueryURL is a multivalued attribute according to its schema definition. Although
memberQueryURL is multivalued, eDirectory 8.6.1 servers used only the first value of
memberQueryURL.
For example:
An administrator creates a dynamic group, which has two memberQueryURL values:
“ldap:///o=nov??sub?cn=*”
“ldap:///o=org??sub?cn=*”
eDirectory 8.6. x servers use “ldap:///o=nov??sub?cn=*” to compute the members of the group.
They accept more than one query, but only read the first query.
This limitation was overcome in eDirectory 8.7.3. eDirectory 8.7.3 servers compute the
members based on all the memberQueryURL values, and the set of members is the union of the
members computed using each of the memberQueryURL values.
In the above example, resultant members of the dynamic group are all entries under o=org and
o=nov, which have cn values.
• member
This property lists all objects in the group. Rights assignments made to the Group object apply
to all members of that group. Adding values to the member property of a dynamic group will
add the static members to the dynamic group. This can be used for specific inclusion of
members.
• excludedMember
The property holds the DNs that are specifically excluded from the membership list of the
dynamic group. This can be used to construct exclusion lists for dynamic groups.
excludedMember is used to exclude DNs from being dynamic members of a dynamic group.
Thus, a DN is a dynamic member of a dynamic group only if it is selected by the member
criteria specified by memberQueryURL and is not listed in excludedMember or explicitly
added to uniqueMember or member.
• staticMember
This property reads the static members of a dynamic group and also determines whether a DN
is a static member of a dynamic group. staticMember can find the dynamic groups in which a
DN is a static member alone and can also find which groups have dynamic members and no
static members.
To add this property to the existing dynamic groups, extend the schema using dgstatic.sch.