34
Novell eDirectory 8.8 Administration Guide
n
ov
do
cx (e
n)
22
Ju
n
e 20
09
NOTE:
To address exceptions to the listing created by the memberQueryURL, dynamic groups also
allow for explicit inclusion and exclusion of users.
Dynamic groups can be created and managed through Novell iManager. You can access the
Dynamic Group management tasks by clicking the
Dynamic Groups
role on the Roles and Tasks
page.
You can also use LDAP commands to manage such groups. The most useful properties associated
with dynamic groups are dgIdentity and memberQueryURL.
Important Properties
The most useful properties of the Group object are Members and Rights to Files and Directories. For
a complete list of properties, select a Group object in iManager. To display a description for each
page of properties, click
Help
.
dgAllowDuplicates
Specifies whether or not duplicates are allowed while printing dynamic group members. The
default is TRUE.
dgIdentity
This property holds the DN whose identity the dynamic group will use for authentication while
searching. The identity must be on the same partition as the dynamic group. The object
specified by dgldentity should have the necessary rights to do the search specified in the
memberQueryURL attribute.
For example, if memberQueryURL value is
“ldap:///o=nov??sub?(title=*)”
then dgldentity should have read/compare rights on the attribute title below the container
o=nov.
dgTimeout
This property specifies the maximum duration a server can take to read or compare a member
attribute before it times out. When the server exceeds this dgTimeout value, the -6016 error is
displayed.
memberQueryURL
This property defines the set of rules that match with the attributes of the group members.
memberQueryURL is a multivalued attribute according to its schema definition. Although
memberQueryURL is multivalued, eDirectory 8.6.1 servers used only the first value of
memberQueryURL.
For example:
An administrator creates a dynamic group, which has two memberQueryURL values:
“ldap:///o=nov??sub?cn=*”
“ldap:///o=org??sub?cn=*”
eDirectory 8.6.
x
servers use “ldap:///o=nov??sub?cn=*” to compute the members of the group.
They accept more than one query, but only read the first query.
This limitation was overcome in eDirectory 8.7.3. Now, eDirectory servers compute the
members based on all the memberQueryURL values, and the set of members is the union of the
members computed using each of the memberQueryURL values.
Summary of Contents for EDIRECTORY 8.8 SP5
Page 4: ...4 Novell eDirectory 8 8 Administration Guide novdocx en 22 June 2009...
Page 72: ...72 Novell eDirectory 8 8 Administration Guide novdocx en 22 June 2009...
Page 118: ...118 Novell eDirectory 8 8 Administration Guide novdocx en 22 June 2009...
Page 130: ...130 Novell eDirectory 8 8 Administration Guide novdocx en 22 June 2009...
Page 188: ...188 Novell eDirectory 8 8 Administration Guide novdocx en 22 June 2009...
Page 222: ...222 Novell eDirectory 8 8 Administration Guide novdocx en 22 June 2009...
Page 240: ...240 Novell eDirectory 8 8 Administration Guide novdocx en 22 June 2009...
Page 264: ...264 Novell eDirectory 8 8 Administration Guide novdocx en 22 June 2009...
Page 290: ...290 Novell eDirectory 8 8 Administration Guide novdocx en 22 June 2009...
Page 322: ...322 Novell eDirectory 8 8 Administration Guide novdocx en 22 June 2009...
Page 540: ...540 Novell eDirectory 8 8 Administration Guide novdocx en 22 June 2009...
Page 548: ...548 Novell eDirectory 8 8 Administration Guide novdocx en 22 June 2009...
Page 616: ...616 Novell eDirectory 8 8 Administration Guide novdocx en 22 June 2009...
