Novell EDIRECTORY 8.8 SP3, Administration Manual, Page: 33 / 634

Understanding Novell eDirectory 33
n
ov
do
cx (e
n)
11
Ju
ly 20
08
Usage
Container objects let you manage all User objects in that container, and Group objects are for
subsets within a container or in multiple containers.
Group objects have two main purposes:
Š They allow you to grant rights to a number of User objects at once.
Š
They allow you to specify login script commands using the
IF MEMBER OF
syntax.
Static Groups
Static groups identify the member objects explicitly. Each member is assigned to the group
explicitly.
These groups provide a static list of members, as well as referential integrity between the members
list of the group and the members of attributes on an object. Group membership is managed
explicitly through the member attribute.
Dynamic Groups
Dynamic groups use an LDAP URL to define a set of rules which, when matched by eDirectory
User objects, define the members of the group. Dynamic group members share a common set of
attributes as defined by the search filter specified in the URL. For more information on the LDAP
URL format, see
RFC 2255 (http://www.ietf.org/rfc/rfc2255.txt) .
Dynamic groups let you specify the criteria to be used for evaluating membership in a group. The
actual members of the group are dynamically evaluated by eDirectory, which lets you define the
group members in terms of a logical grouping and lets eDirectory automatically add and remove
group members. This solution is more scalable, reduces administrative costs, and can supplement
normal groups in LDAP to provide increased flexibility.
eDirectory lets you create a dynamic group when you want to automatically group users based on
any attribute, or when you want to apply ACLs to specific groups that contain matching DNs. For
example, you can create a group that automatically includes any DN that contains the attribute
Department=Marketing. If you apply a search filter for Department=Marketing, the search returns a
group including all DNs containing the attribute Department=Marketing. You can then define a
dynamic group from the search results based on this filter. Any User added to the directory who
matches the Department=Marketing criteria is automatically added to the group. Any User whose
Department is changed to another value (or who is removed from the directory) is automatically
removed from the group.
Dynamic groups are created in eDirectory by creating an object of type objectclass=dynamicGroup.
A static Group object can be converted into a dynamic group by associating an auxiliary class,
dynamicGroupAux, to the Group object. The dynamic group has the memberQueryURL attribute
associated with it.
A dgIdentity attribute can be set on the Dynamic Group object to the distinguished name of an entry,
whose credentials and rights should be used to expand the dynamic members of the group.
The groups are managed using the memberQueryURL. A typical memberQueryURL has a base DN,
a scope, a filter, and an optional extension. The base DN specifies the search base. Scope specifies
the levels below the base to search, and filter is the search filter based on which entries are selected
from within the specified scope.