Re: dynamic groups

[Mark W. <mew...@un...>]

I have an article on groups that answer many of these questions at
www.webtechniques.com either search for wilcox or LDAP.

But I'll try to answer inline as well.

Tom Jordan wrote:

> Hey Folks,
>
> I'm trying to get a handle on dynamic groups (and groups in general), and
> have a few questions:
>
> 1. Is the concept of a dynamic group a netscape-only feature?

Yes and no. The groupOfUrls object can be used in any LDAP server. But dynamic
groups are really a feature implemented by the rest of the IPlanet line (ie
Enterprise and Mail servers) for authorization services. However, I use them
all of the time for my other applications.

>
>
> 2. Netscape's docs state that dynamic groups are of the type 'groupOfURLs'
> with the actual group membership criteria listed in the 'memberURL'
> attribute. Is it the client's responsibility to expand this URL into list of
> dn's? If so, what happens with big groups where the number ofentries will
> exceed the searchlimit?

Of course it's the client's responsibility that's the whole reason for
groupOfUrls. instead of keeping a list of all of the members in the group
object itself, the entire list is only generated when needed (if that search
should exceed a search limit, then you'll need to use a Virtual List View or
similar to control). However, most (95%) group accesses is part of
authentication/authorization services. IE, only members of the Engineering
group are allowed access to this web site. In that case you only have to
determine if the user's entry would satisfy the query contained in the
memberURL.

>

>
> 3. Does anyone have suggestions for handling groups where the group
> population is potentially quite large ( > 10,000 members)?

That's the whole reason for dynamic groups.

>
>
> 4. Is anyone aware of any practical limits on the number of members in a
> group?

In theory no. In practicality yes. Iplanet 4 it's around 15,000. I don't know
what others are but I imagine their similar.

Mark

>
>
> Thanks much,
>
> Tom Jordan
> University of Wisconsin Madison