Defines values representing an unordered set of names. The names themselves can represent individual objects or other groups of names.
|
Class Flags |
Setting |
|---|---|
|
Container |
Off |
|
Effective |
On |
|
Nonremovable |
On |
|
Ambiguous Naming |
Off |
|
Ambiguous Container |
Off |
|
Auxiliary Class |
Off |
|
Rule |
Class/Attribute |
Defined For |
|---|---|---|
|
Super Classes |
Group |
|
|
Containment |
Group Group Group |
|
|
Named By |
Group |
|
Group |
Inherited from Top |
|---|---|
|
Group |
|
|---|---|
|
Inherited from Top |
|
|---|---|
|
Object Name |
Default Rights |
Affected Attributes |
Class Defined For |
|---|---|---|---|
|
[Creator] |
Supervisor |
[Entry Rights] |
For help in understanding the class definition template, see Reading Class Definitions.
The membership of a group is static; that is, it is explicitly modified by administrative action, rather than dynamically determined each time the group is referred to. The membership of a group can be reduced to a set of individual object’s names by replacing each group with its membership. This process can be carried out recursively until all constituent group names have been eliminated, and only the names of individual objects remain.
In general, eDirectory operations do not perform recursive membership expansion. However, access control resolution effectively expands one level of groups listed in an Access Control List (ACL). Thus, if A is a member of group B, which is in turn listed in an ACL, A gains the access granted to group B. However, if A is a member of group B, which is a member of group C, and C is listed in an access control list, A does not gain the access granted to group C.
Other applications are free to perform recursive group expansion, if they so choose.
The L (Locality Name, O (Organization Name), and OU (Organizational Unit Name) attributes might already be present in the group’s Distinguished Name. They are repeated here to aid searching when an organization spans multiple subtrees in the eDirectory tree. Additional values for the locality, organization or organizational unit may be useful when a group contains members from multiple organizations, organizational units, or localities.
The Owner attribute could be used to contain the name of the group leader or group moderator. This value might not be the same as the set of individuals authorized to modify the group object.
The See Also attribute might be used to list related groups. For example, the groups “Project A Programmers,” “Project A Writers,” and “Project A Testers” might mention one another in their See Also attributes.