PingDirectory

Searching virtual static groups

Virtual static groups behave like static groups, so the process for determining whether a user is a member of a virtual static group is identical to that of a member in a static group.

The process for determining all virtual static groups in which a user is a member is similar to the process for standard static groups in which a user is a member. The query provided in the static groups discussion returns virtual static groups in addition to standard static groups because the structural object class of a virtual static group is the same as the structural object class for a static group.

You can retrieve a list of all members of a virtual static group in the same way as a standard static group: retrieve the member or uniqueMember attribute of the desired group. However, because virtual static groups are backed by dynamic groups and the process for retrieving member information for dynamic groups can be expensive, virtual static groups do not allow retrieving the full set of members by default.

To make the configuration change to allow full membership retrieval, update the virtual attribute used to expose membership.

$ bin/dsconfig set-virtual-attribute-prop --name "Virtual Static member" \
  --set allow-retrieving-membership:true

This can be an expensive operation, so you should leave the option to allow retrieving virtual static group membership as disabled unless it is required.