LDAP-UX Client Services B.04.10 Administrator's Guide (edition 7)

Number of Group Members Returned

With dynamic membership support, as with regular (static) group membership support, the

number of group members for a specific group returned by

getgrnam()/getgrgid()/getgrent() on an HP-UX system is limited by internal buffer

sizes. On HP-UX 11i v1 and v2 systems, the buffer size is 7296 bytes for 32bit applications and

10496 bytes for 64bit applications. This limitation is mainly impacted by the size of each member

name. For detailed description, refer to the Preparing your Directory for LDAP-UX Integration white

paper under the "Account and Group Management" collection available at the following web

site:

http://docs.hp.com/en/internet.html

During the login process, information for getting group members is not requested. The login

time will not be affected by processing group members.

Number of Groups Returned for a Specific User

When “ldap” is configured in the /etc/nsswitch.conf file as a data repository for the group

service (see nsswitch.conf(4)), if an LDAP user logs into an HP-UX system, LDAP-UX is

involved to return all groups that the user belongs to. The login application (e.g. login) initializes

the user's group access based on the group information returned by LDAP-UX.

Information for getting groups that a specific user belongs to is requested by LDAP-UX during

v1 and v2 systems. If the user belongs to more than 20 groups, only the first 20 groups are

returned. The support of dynamic groups does not change the system limitation.

Depending on how you configure groups, if those 20 groups happens to be the last entries of

thousands of dynamic groups, the login time could be long and performance could be impacted.

Based on the configuration of memberUid attribute mappings, LDAP-UX may return static

and/or dynamic groups. The first memberUid mapped attribute determines if LDAP-UX returns

static or dynamic groups first. If the first memberUid mapped attribute is a static group attribute

(such as memberUid, member or uniquemember), LDAP-UX returns static groups first. If there

are less than 20 static groups, LDAP-UX then returns dynamic groups for the rest groups.

However, if the first memberUid mapped attribute is a dynamic group attribute (such as

memberURL or nxSearchFilter), LDAP-UX returns dynamic groups first. If there are less

than 20 dynamic groups, LDAP-UX then returns static groups for the rest groups.

With this design, a group containing both static and dynamic group attributes will be always

processed, but will be limited to the first 20 groups.

For example, if a user belongs to 8 static groups and 20 dynamic groups, and you map memberUid

to memberUid memberURL, LDAP-UX will return 8 static groups and 12 dynamic groups. If

you map memberUid to memberURL memberUid, LDAP-UX will return 20 dynamic groups

without any static groups.

84 Dynamic Group Support