PingDirectory

Converting static groups to inverted static groups

You can convert a traditional static group to an inverted static group to improve performance for groups with large member lists.

Converting a group is not an atomic operation. Clients that rely on the group will experience a brief disruption between the time the traditional static group is deleted and the time all member entries are updated.

Before you begin

Before converting a group, identify any member entries that are groups rather than users. The inverted static group referential integrity plugin prevents adding group entries as direct members of an inverted static group. Add those entries as nested groups using ds-nested-group-dn instead.

Steps

  1. Search for the traditional static group to retrieve its full member list. Groups with the groupOfNames or groupOfEntries object class store members in the member attribute, while groups with the groupOfUniqueNames object class use the uniqueMember attribute instead. Request both attributes so that the search returns the correct member list regardless of the group’s object class.

    Example:

    $ bin/ldapsearch --baseDN "<group_DN>" --searchScope base "(objectClass=*)" member uniqueMember

  2. Review the list of members and identify any entries that are groups. Add those entries as nested groups (in step 6) rather than as direct members.

  3. Delete the traditional static group entry.

    Example:

    dn: <group_DN>
changetype: delete

    Save this LDIF content to a file, then use the ldapmodify tool to apply it:

    $ bin/ldapmodify --filename delete-group.ldif

  4. Add a new inverted static group at the same DN.

    Example:

    dn: <group_DN>
changetype: add
objectClass: top
objectClass: ds-inverted-static-group
cn: <group_cn>
    $ bin/ldapmodify --filename add-inverted-group.ldif

  5. For each user member, update the user entry to add the group DN to the ds-member-of-inverted-static-group-dn attribute.

    Example:

    dn: <user_DN>
changetype: modify
add: ds-member-of-inverted-static-group-dn
ds-member-of-inverted-static-group-dn: <group_DN>
    $ bin/ldapmodify --filename add-members.ldif

  6. For each group member identified in step 2, update the inverted static group entry to add the nested group’s DN to the ds-nested-group-dn attribute. If the group has multiple nested groups, you can add all of their DNs in a single modification by providing multiple values for ds-nested-group-dn.

    Example:

    dn: <group_DN>
changetype: modify
add: ds-nested-group-dn
ds-nested-group-dn: <nested_group_DN>
ds-nested-group-dn: <additional_nested_group_DN>
    $ bin/ldapmodify --filename add-nested-groups.ldif

  7. Verify that the server considers the expected users as members of the inverted static group, using the isMemberOf virtual attribute.

    • Check a single member’s entry.

      Example:

      $ bin/ldapsearch --baseDN "<user_DN>" --searchScope base "(objectClass=*)" isMemberOf

    • Search for all expected members at once, using a base DN that’s higher in the DIT than all of the member entries.

      Example:

      $ bin/ldapsearch --baseDN "<search_base_DN>" --searchScope sub "(isMemberOf=<group_DN>)"

Next steps

If any application that uses the group expects traditional static group behavior, enable the Traditional Static Group Support for Inverted Static Groups plugin. Learn more in Using inverted static groups with applications.