Sun Microsystems Netscape Enterprise Server, Руководство администратора

Страница: 97 / 532

Chapter 4, Managing Users and Groups 97
Creating Groups
The object defines the members of the group, either by explicitly enumerating
the member DNs (as is done for
groupOfUniqueNames
for static groups), or
by specifying LDAP URLs (for example,
groupOfURLs
).
Groups Can Be Static and Dynamic
A group object can have both
objectclass = groupOfUniqueMembers
and
objectclass = groupOfURLs
; therefore, both “
uniqueMember
” and
“
memberURL
” attributes are valid. The group’s membership is the union of its
static and dynamic members.
Dynamic Group Impact on Server Performance
There is a server performance impact when using dynamic groups. If you are
testing group membership, and the DN is not a member of a static group,
Enterprise Server checks all dynamic groups in the database’s baseDN.
Enterprise Server accomplishes this task by checking if each
memberURL
matches by checking its baseDN and scope against the DN of the user, and
then performing a base search using the user DN as baseDN and the filter of
the
memberURL
. This procedure can amount to a large number of individual
searches.
Guidelines for Creating Dynamic Groups
Consider the following guidelines when using the Enterprise Administration
Server forms to create new dynamic groups:
• Dynamic groups can not contain other groups.
• Enter the group’s LDAP URL using the following format (without
host
and
port
info, since these parameters are ignored):
ldap:///<basedn>?<attributes>?<scope>?<(filter)>
The required parameters are described in the following table: