PingDirectory

Using static groups

A static group uses a multivalued attribute to contain an explicit membership list of distinguished names (DNs).

The PingDirectory server supports three types of static groups: groupOfNames, groupOfUniqueNames, and groupOfEntries. The following definitions describe each type of static group.

groupOfNames

A static group that is defined with the groupOfNames structural object class and uses the member attribute to hold the DNs of its members.

RFC 4519 requires the member attribute to be present in an entry. The PingDirectory server has relaxed this restriction by making the member attribute optional so that the last member in the group can be removed. The following entry depicts a group defined with the groupOfNames object class.

dn: cn=Test Group,ou=Groups,dc=example,dc=com
objectClass: top
objectClass: groupOfNames
cn: Test Group
member: uid=user.1,ou=People,dc=example,dc=com
member: uid=user.2,ou=People,dc=example,dc=com
member: uid=user.3,ou=People,dc=example,dc=com
groupOfUniqueNames

A static group that is defined with the groupOfUniqueNames structural object class and uses the uniqueMember attribute to hold the DNs of its members.

RFC 4519 requires the uniqueMember attribute to be present in an entry. The PingDirectory server has relaxed this restriction by making the uniqueMember attribute optional so that the last member in the group can be removed. The following entry depicts a group defined with the groupOfUniqueNames object class.

dn: cn=Test Group,ou=Groups,dc=example,dc=com
objectClass: top
objectClass: groupOfUniqueNames
cn: Test Group
uniqueMember: uid=user.1,ou=People,dc=example,dc=com
uniqueMember: uid=user.2,ou=People,dc=example,dc=com
uniqueMember: uid=user.3,ou=People,dc=example,dc=com
groupOfEntries

A static group that is defined with the groupOfEntries object class and uses the member attribute to hold the DNs of its members.

This group specifies that the member attribute is optional so that the last member can be removed from the group. Although the draft proposal (draft-findlay-ldap-groupofentries-00.txt) has expired, the PingDirectory server supports this implementation. The following entry depicts a group defined with the groupOfEntries object class.

dn: cn=Test Group,ou=Groups,dc=example,dc=com
objectClass: top
objectClass: groupOfEntries
cn: Test Group
member: uid=user.1,ou=People,dc=example,dc=com
member: uid=user.2,ou=People,dc=example,dc=com
member: uid=user.3,ou=People,dc=example,dc=com