PingDirectory

Using virtual static groups

Virtual static groups make it possible to get the efficiency and ease of management of a dynamic group while allowing clients to interact with them as a static group.

Static groups can be easier to interact with than dynamic groups, but large static groups can be expensive to manage and require a large amount of memory to hold in the internal group cache. The PingDirectory server provides a third type of group: a virtual static group, which references another group and provides access to the members of that group as if it was a static group.

Steps

  • To create a virtual static group, create an entry that has a structural object class of either groupOfNames or groupOfUniqueNames and an auxiliary class of ds-virtual-static-group.

    It should include a ds-target-group-dn attribute, whose value is the group from which the virtual static group should obtain its members.

    You must also enable a virtual attribute that allows the member attribute to be generated based on membership for the target group.

    Example:

    This example creates a virtual static group that exposes the members of the cn=Sales Group,ou=Groups,dc=example,dc=com dynamic group as if it were a static group.

    dn: cn=Virtual Static Sales Group,ou=Groups,dc=example,dc=com
objectClass: top
objectClass: groupOfNames
objectClass: ds-virtual-static-group
cn: Virtual Static Sales Group
ds-target-group-dn: cn=Sales Group,ou=Groups,dc=example,dc=com

  • To enable a configuration object for the virtual static member attribute, use the set-virtual-attribute-prop option with dsconfig.

    Example:

    $ bin/dsconfig set-virtual-attribute-prop --name "Virtual Static member" \
  --set enabled:true

    A configuration object for this virtual attribute is in the server configuration but is disabled by default.

    If you want to use virtual static groups with the groupOfUniqueNames object class, enable the Virtual Static uniqueMember virtual attribute in the same way.

Membership changes

Changes to virtual static group membership must be made on the target group. The server doesn’t prevent you from modifying the member or uniqueMember attribute on a virtual static group entry, but the modification doesn’t change the group’s membership:

  • Adding or replacing values succeeds, but the values don’t appear in the group’s membership and aren’t returned by searches.

  • Deleting values fails with a no such attribute result because the member values are generated, not stored on the entry.

This behavior is a consequence of how the server handles write operations to virtual attributes. Learn more in Virtual attribute limitations.