LDAP-UX Client Services B.04.10 with Microsoft Windows Active Directory Server Administrator's Guide

or groupOfUniqueNamesobjectclass. A list of ldap_group names is
specified in the <object> field. The group membership information is
stored in the LDAP directory server. An example of a ldap_group type
of access rule is as follows:
deny:ldap_group:engineering_ldapgroup,support_ldapgroup,epartner_ldapgroup
PAM_AUTHZ retrieves group membership of each listed group from
the directory server through LDAP-UX client services. Then, it examines
if the user's Distinguished Name (DN) matches any value in the member
or uniquemember attribute.
PAM_AUTHZ Login Authorization 115