Creating Groups
Chapter
4
Managing Users and Groups
75
The mapping from an ACL to an LDAP database is defined both in the
dbswitch.conf
configuration file (which associates the ACL database names with
actual LDAP database URLs) and the ACL file (which defines which databases are
to be used for which ACL). For example, if you want base access rights on
membership in a group named “staff,” the ACL code looks up an object that has an
object class of
groupOf
<anything>
and a CN set to “staff.” The object defines the
members of the group, either by explicitly enumerating the member DNs (as is
done for
groupOfUniqueNames
for static groups), or by specifying LDAP URLs (for
example,
groupOfURLs
).
Groups Can Be Static and Dynamic
A group object can have both
objectclass = groupOfUniqueMembers
and
objectclass = groupOfURLs
; therefore, both “
uniqueMember
” and “
memberURL
”
attributes are valid. The group’s membership is the union of its static and dynamic
members.
Dynamic Group Impact on Server Performance
There is a server performance impact when using dynamic groups. If you are
testing group membership, and the DN is not a member of a static group,
Enterprise Server checks all dynamic groups in the database’s baseDN. Enterprise
Server accomplishes this task by checking if each
memberURL
matches by checking
its baseDN and scope against the DN of the user, and then performing a base
search using the user DN as baseDN and the filter of the
memberURL
. This
procedure can amount to a large number of individual searches.
Guidelines for Creating Dynamic Groups
Consider the following guidelines when using the Administration Server forms to
create new dynamic groups:
•
Dynamic groups can not contain other groups.
•
Enter the group’s LDAP URL using the following format (without
host
and
port
info, since these parameters are ignored):
ldap:///<basedn>?<attributes>?<scope>?<(filter)>
The required parameters are described in the following table:
Summary of Contents for NETSCAPE ENTREPRISE SERVER 6.0 - ADMINISTRATOR
Page 1: ...Administrator s Guide Netscape Enterprise Server Version6 0 November 2001...
Page 18: ...18 Netscape Enterprise Server Administrator s Guide November 2001...
Page 26: ...26 Netscape Enterprise Server Administrator s Guide November 2001...
Page 48: ...Migrating a Server 48 Netscape Enterprise Server Administrator s Guide November 2001...
Page 50: ...50 Netscape Enterprise Server Administrator s Guide November 2001...
Page 146: ...146 Netscape Enterprise Server Administrator s Guide November 2001...
Page 242: ...242 Netscape Enterprise Server Administrator s Guide November 2001...
Page 294: ...294 Netscape Enterprise Server Administrator s Guide November 2001...
Page 332: ...Deleting a Virtual Server 332 Netscape Enterprise Server Administrator s Guide November 2001...
Page 378: ...378 Netscape Enterprise Server Administrator s Guide November 2001...
Page 396: ...Responses 396 Netscape Enterprise Server Administrator s Guide November 2001...
Page 414: ...Posting to JSPs 414 Netscape Enterprise Server Administrator s Guide November 2001...
Page 432: ...Further Information 432 Netscape Enterprise Server Administrator s Guide November 2001...
Page 444: ...444 Netscape Enterprise Server Administrator s Guide November 2001...
