FreeBSD Manual Pages
SLAPO-AUTOGROUP(5) File Formats Manual SLAPO-AUTOGROUP(5) NAME slapo-autogroup - automatic updates of group memberships which meet the re- quirements of any filter contained in the group definition. SYNOPSIS In slapd.conf: ... include ETCDIR/schema/dyngroup.schema ... moduleload autogroup.so ... database ... ... overlay autogroup autogroup-attrset groupOfURLs memberURL member DESCRIPTION The autogroup overlay to slapd(8) allows automated updates of group member- ships which meet the requirements of any filter contained in the group def- inition. The filters are built from LDAP URI-valued attributes. Any time an object is added/deleted/updated, it is tested for compliance with the fil- ters, and its membership is accordingly updated. For searches and compares, it behaves like a static group. If the attribute part of the URI is filled, the group entry is populated by the values of this attribute in the entries resulting from the search. Note that filters that use attributes that are themselves dynamically com- puted may not work consistently, and should be avoided. CONFIGURATION Either slapd.conf(5) or the cn=config methodology of slapd-config(5) may be used for configuring autogroup. Both syntaxes are provided here for conve- nience: autogroup-attrset <group-oc> <URL-ad> <member-ad> olcAutoGroupAttrSet: <group-oc> <URL-ad> <member-ad> This defines the objectclass-attribute-URI mappings defining the au- tomatically managed groups, and may appear multiple times. The value <group-oc> is the name of the objectClass that represents the group. The value <URL-ad> is the name of the attributeDescription that con- tains the URI that is converted to the filters. If no URI is present, there will be no members in that group. It must be a sub- type of labeledURI. The value <member-ad> is the name of the attributeDescription that specifies the member attribute. User modification of this attribute is disabled for consistency. autogroup-memberof-ad <memberof-ad> olcAutoGroupMemberOfAd <memberof-ad> This defines the attribute that is used by the memberOf overlay to store the names of groups that an entry is member of; it must be DN- valued. It should be set to the same value as memberof-memberof-ad. It defaults to 'memberOf'. EXAMPLES As above in SYNOPSIS, or with memberof: ... include ETCDIR/schema/dyngroup.schema include ETCDIR/schema/memberof.schema ... moduleload autogroup.so moduleload memberof.so ... database ... ... overlay memberof memberof-memberof-ad foo ... overlay autogroup autogroup-attrset groupOfURLs memberURL member autogroup-memberof-ad foo CAVEATS As with static groups, update operations on groups with a large number of members may be slow. If the attribute part of the URI is specified, modify and delete operations are more difficult to handle. In these cases the overlay will try to detect if groups have been modified and then simply re- fresh them. This can cause performance hits if the search specified by the URI deals with a significant number of entries. BACKWARD COMPATIBILITY The autogroup overlay has been reworked with the 2.5 release to use a con- sistent namespace as with other overlays. As a side-effect the following cn=config parameters are deprecated and will be removed in a future re- lease: * olcAGattrSet is replaced with olcAutoGroupAttrSet * olcAGmemberOfAd is replaced with olcAutoGroupMemberOfAd * olcAutomaticGroups is replaced with olcAutoGroupConfig ACKNOWLEDGEMENTS This module was originally written in 2007 by MichaA SzulczyAski. Further enhancements were contributed by Howard Chu, Raphael Ouazana, Norbert Pueschel, and Christian Manal. Manpage updates provided by Emily Backes. SEE ALSO slapd.conf(5), slapd(8). Copyrights Copyright 1998-2026 The OpenLDAP Foundation. Portions Copyright (C) 2007 MichaA SzulczyAski. All rights reserved. OpenLDAP LDVERSION RELEASEDATE SLAPO-AUTOGROUP(5)
NAME | SYNOPSIS | DESCRIPTION | CONFIGURATION | EXAMPLES | CAVEATS | BACKWARD COMPATIBILITY | ACKNOWLEDGEMENTS | SEE ALSO | Copyrights
Want to link to this manual page? Use this URL:
<https://man.freebsd.org/cgi/man.cgi?query=slapo-autogroup&sektion=5&manpath=FreeBSD+Ports+15.1.quarterly>