mail us  |  mail this page

contact us
training  | 
tech stuff  | 

Configuring Groups

Groups are a quick way of giving users common access to certain features or functionality within an LDAP directory. The access to directive (cn=config, olcAccess) contains a group specific variant in the <who> clause for just this purpose. The actual rights assigned to the group are also defined in the Access to directive (cn=config, olcAccess). Groups use the groupofnames objectClass.

Note: Groups defined using groupOfNames are essentially static and require explicit action to define each group member. Where the number of group members are either very long or change very frequently it can become a serious pain. LDAP also provides a non-standarized (there is no RFC), but widely implemented, feature called Dynamic Groups using the groupOfURLs objectClass.

Example:

The following LDIF fragments shows building a group called itpeople who could be given privileges to access or change passwords or configuration parameters in user entries. The individual group member entries are assumed to already exist in the directory under a classic ou=people branch. This configuration creates a separate branch called groups under which is placed the itpeople group. The following diagram illustrates this organisation:

DIT - with a groups branch added
# LDIF fragment to create group branch under root

dn: ou=groups,dc=example,dc=com
objectclass:organizationalunit
ou: groups
description: generic groups branch

# create the itpeople entry

dn: cn=itpeople,ou=groups,dc=example,dc=com
objectclass: groupofnames
cn: itpeople
description: IT security group
# add the group members all of which are 
# assumed to exist under people
member: cn=road runner,ou=people,dc=example,dc=com
member: cn=micky mouse,ou=people,dc=example,dc=com
...

A DN of cn=itpeople,ou=groups,dc=example,dc=com will then reference all defined members of this group. Anyone logged in as 'micky mouse' can be assigned itpeople privileges using an appropriate access to directive (cn=config, olcAccess). See a worked example of group usage.

up icon



Problems, comments, suggestions, corrections (including broken links) or something to add? Please take the time from a busy life to 'mail us' (at top of screen), the webmaster (below) or info-support at zytrax. You will have a warm inner glow for the rest of the day.

Contents

tech info
guides home
intro
contents
1 objectives
big picture
2 concepts
3 ldap objects
quickstart
4 install ldap
5 samples
6 configuration
7 replica & refer
reference
8 ldif
9 protocol
10 ldap api
operations
11 howtos
12 trouble
13 performance
14 ldap tools
security
15 security
appendices
notes & info
ldap resources
rfc's & x.500
glossary
ldap objects
change log

Creative Commons License
This work is licensed under a Creative Commons License.

If you are happy it's OK - but your browser is giving a less than optimal experience on our site. You could, at no charge, upgrade to a W3C STANDARDS COMPLIANT browser such as Firefox

Search

web zytrax.com

Share

Icons made by Icomoon from www.flaticon.com is licensed by CC 3.0 BY
share page via facebook tweet this page

Page

email us Send to a friend feature print this page Display full width page Decrease font size Increase font size

Resources

Systems

FreeBSD
NetBSD
OpenBSD
DragonFlyBSD
Linux.org
Debian Linux

Software

LibreOffice
OpenOffice
Mozilla
GitHub
GNU-Free SW Foundation
get-dns

Organizations

Open Source Initiative
Creative Commons

Misc.

Ibiblio - Library
Open Book Project
Open Directory
Wikipedia

Site

CSS Technology SPF Record Conformant Domain
Copyright © 1994 - 2017 ZyTrax, Inc.
All rights reserved. Legal and Privacy
site by zytrax
Hosted by super.net.sg
web-master at zytrax
Page modified: October 21 2015.