You can define a group by:
- Specifying attributes that all members have in common (“All the software developers in Grenoble”).
- Listing the members (“Alice, Bob, Carol”).
- Using a mix of both (all the software developers in Grenoble, plus Alice, Bob, and Carol).
Notice that when you define a group by attributes of its members, the size of the definition is not a function of the size of the group. “All the software developers in Grenoble” remains the same size, even if the number of software developers in Grenoble varies.
Also notice that when you define a group by listing its members, the size of the definition depends mainly on the size of the group. “Alice, Bob, Carol” is about half the size of “Alice, Bob, Carol, Dan, Elena, Francis.”
OpenDJ directory server has groups of each of these types.
- OpenDJ represents groups as directory entries. The group entry’s
objectClasstells you what type of group it is.
- Dynamic groups work by specifying attributes that all members have in common. They identify members by LDAP URLs, as in
memberUrl: ldap:///ou=Developers,ou=People,dc=example,dc=com??sub?l=Grenoble. This is like specifying members by LDAP search, as in
ldapsearch --baseDN ou=Product Development,ou=People,dc=example,dc=com "(l=Grenoble)".
Dynamic group entries have
objectClass: groupOfUrls. Dynamic group entries generally remain small even when they have lots of members.
- Static groups list each member. Static group entries can have several object classes in OpenDJ, including
For groups with
objectClass: groupOfEntriesthe member attribute is member, as in
member: uid=Alice,ou=People,dc=example,dc=com member: uid=Bob,ou=People,dc=example,dc=com member: uid=Carol,ou=People,dc=example,dc=com member: cn=Grenoble Developers,ou=Groups,dc=example,dc=com
As you would expect, static group entries get larger as you add members.
You can nest groups, too, by adding a group as a member of a group. (For instance, the last member in the example is the Grenoble Developers group.)
When you delete an entry or rename an entry, you no longer want it referenced in static groups. OpenDJ has a referential integrity plugin to handle this.
- When you look up a dynamic group in OpenDJ what you get is the
memberUrlvalue. This is fine if you are ready to use the LDAP URL, but not so great if you just wanted a list of the member entries. OpenDJ therefore provides what are called virtual static groups. Virtual static groups have OpenDJ look up the members of a dynamic group, and then return the list when you read the entry.
Checking group membership
In general, avoid reading and writing whole static group entries, because static groups can be large. Why read an entire 1-million-member static group entry over the network when all you want is to do is check membership for one or two entries?
To make it easy to check group membership, OpenDJ provides a virtual attribute,
isMemberOf. If you explicitly request
isMemberOf with a search, the values OpenDJ returns are the DNs of groups the entry belongs to. Reading
isMemberOf is the recommended way to look up group membership.
Updating static groups
You can update a large OpenDJ static group without reading the group, and without checking membership beforehand. Use the Permissive Modify control (
If you have an application that needs notification of changes to groups, OpenDJ has you covered there as well. Instead of polling group entries, you can use the external change log mechanism. The external change log is related to directory replication.
Where to go from here
This discussion of OpenDJ groups only scratches the surface. To dig a bit deeper, have a look at these sections in the documentation:
- Working With Groups of Entries
- Updating Static Groups (with OpenDJ LDAP SDK)
- Change Notification For Your Applications