Sun Microsystems Netscape Enterprise Server, Руководство администратора

Страница: 96 / 532

Creating Groups
96 Netscape Enterprise Server Administrator’s Guide
This section includes the following topics:
• How Enterprise Server 4.0 Implements Dynamic Groups
• Groups Can Be Static and Dynamic
• Dynamic Group Impact on Server Performance
• Guidelines for Creating Dynamic Groups
• To Create a Dynamic Group
How Enterprise Server 4.0 Implements Dynamic
Groups
Enterprise Server 4.0 implements dynamic groups in the LDAP server schema as
objectclass = groupOfURLs
. A
groupOfURLS
class can have multiple
memberURL
attributes, each one consisting of an LDAP URL that enumerates a
set of objects in the directory. The members of the group would be the union
of these sets. For example, the following group contains just one member URL:
ldap:///o=mcom.com??sub?(department=marketing)
This example describes a set that consists of all objects below “
o=mcom.com
”
whose department is “marketing.”
The LDAP URL can contain a search base DN, a scope and filter, however, not
a hostname and port. This means that you can only refer to objects on the same
LDAP server. All scopes are supported.
The DNs are included automatically, without your having to add each
individual to the group. The group changes dynamically, because Enterprise
Server performs an LDAP server search each time a group lookup is needed for
ACL verification. The user and group names used in the ACL file correspond to
the
cn
attribute of the objects in the LDAP database.
Note
Enterprise Server 4.0 uses the
cn
(
commonName
) attribute as group name for
ACLs.
The mapping from an ACL to an LDAP database is defined both in the
dbswitch.conf
configuration file (which associates the ACL database names
with actual LDAP database URLs) and the ACL file (which defines which
databases are to be used for which ACL). For example, if you want base access
rights on membership in a group named “staff,” the ACL code looks up an
object that has an object class of
groupOf <anything>
and a CN set to “staff.”