LDAP-UX Client Services B.04.10 with Microsoft Windows Active Directory Server Administrator's Guide

Number of Group Members Returned

With dynamic membership support, as with regular (static) group membership support, the

number of group members for a specific group returned by

getgrnam()/getgrgid()/getgrent() on an HP-UX system is limited by internal buffer

sizes. On HP-UX 11i v1 and v2 systems, the buffer size is 7296 bytes for 32bit applications and

10496 bytes for 64bit applications. This limitation is mainly impacted by the size of each member

name. For detailed description, refer to the Preparing your Directory for LDAP-UX Integration white

paper under the "Account and Group Management" collection available at the following web

site:

http://docs.hp.com/en/internet.html

During the login process, information for getting group members is not requested. The login

time will not be affected by processing group members.

Number of Groups Returned for a Specific User

When ldap is configured in the /etc/nsswitch.conf file as a data repository for the group

service (see nsswitch.conf(4)), if an LDAP user logs into an HP-UX system, LDAP-UX is

involved to return all groups that the user belongs to. The login application (e.g. login) initializes

the user's group access based on the group information returned by LDAP-UX.

Information for getting groups that a specific user belongs to is requested by LDAP-UX during

v1 and v2 systems. If the user belongs to more than 20 groups, only the first 20 groups are

returned. The support of dynamic groups does not change the system limitation.

Depending on how you configure groups, if those 20 groups happens to be the last entries of

thousands of dynamic groups, the login time could be long and performance could be impacted.

Based on the configuration of memberUid attribute mappings, LDAP-UX may return static

and/or dynamic groups. The first memberUid mapped attribute determines if LDAP-UX returns

static or dynamic groups first. If the first memberUid mapped attribute is a static group attribute

(such as memberUid or member). LDAP-UX returns static groups first. If there are less than 20

static groups, LDAP-UX then returns dynamic groups for the rest groups. On other hand, if the

first memberUid mapped attribute is a dynamic group attribute, msDS-AzLDAPQuery, LDAP-UX

returns dynamic groups first. If there are less than 20 dynamic groups, LDAP-UX then returns

static groups for the rest groups.

For example, if a user belongs to 8 static groups and 20 dynamic groups, and you map memberUid

to memberUid msDS-AzLDAPQuery , LDAP-UX will return 8 static groups and 12 dynamic

groups. If you map memberUid to msDS-AzLDAPQuery memberUid, LDAP-UX will return 20

dynamic groups without any static groups.

Number of Group Members Returned 87