Novell EDIRECTORY 8.8 SP3, Administration Manual, Page: 37 / 634

Understanding Novell eDirectory 37
n
ov
do
cx (e
n)
11
Ju
ly 20
08
Figure 1-5
Nested Groups
Creating Nested Groups
You can use LDAP tools to create the nested groups. A new auxiliary class, nestedGroupAux, along
with the structural class Group represents a nested group. This auxiliary class can be added to the
existing static group object to convert it into a nested group.
Both the contained and the containing group should be nested group objects. Only when the
contained group is a nested group, it can populate the groupMembership attribute (
groupMembership attribute not a part of static group) on it to specify the containing group. If the
contained groups are found to be static group objects or dynamic group objects, only the static
members of the static or dynamic group objects will be listed as nested members.
You can use LDIF files and LDAP tools to manage such groups. The most useful properties
associated with nested groups are groupMember and nestedConfig.
Nested Group Properties
Š
member
By default, the members of a nested group include all the nested members. Therefore, the
member attribute listing always returns all the nested members, and the assertion on the
member attribute returns all the nested group objects. If the configuration is set to 1 (no
nesting), it refers only to the direct members.
Š
groupMembership
groupMembership specifies the group that this object (generally a user object) belongs to. This
attribute is associated with the nestedGroupAux class, and it holds the DN of the nested group
of which this group is a group member. When associated with a group object, it indicates the
nested group of which this group is a member (specifically a groupMember). Similar to
member and groupMember, groupMembership lists all the nested groups of which this group