OpenLDAP Configuring Groups

Groups are a quick way of giving users common access to certain features or functionality within an LDAP directory. The access directive contains a group specific variant in the <who> clause for just this purpose.

Example 1:

The following LDIF fragments shows building a group called itpeople who could be given privileges to access or change passwords or configuration parameters in user entries. The individual group member entries are assumed to already exist in the directory under a classic ou=people branch. This configuration creates a separate branch called groups under which is placed the itpeople group. The following diagram illustrates this organisation:

# LDIF fragment to create group branch under root

dn: ou=groups,dc=example,dc=com
objectclass:organizationalunit
ou: groups
description: generic groups branch

# create the itpeople entry

dn: cn=itpeople,dc=groups,dc=example,dc=com
objectclass: groupofnames
cn: itpeople
description: IT security group
# add the group members all of which are 
# assumed to exist under people
member: cn=road runner,ou=people,dc=example,dc=com
member: cn=micky mouse,ou=people,dc=example,dc=com
...

A DN of cn=itpeople,ou=groups,dc=example,dc=com will then reference all defined members of this group. Anyone logged in as 'micky mouse' will have itpeople privileges.