LDAP-UX Client Services B.04.10 with Microsoft Windows Active Directory Server Administrator's Guide

Dynamic Group with Active Directory Server Multiple Domains
LDAP-UX Client Services supports dynamic groups with the following limitations on ADS
multiple domains:
• For dynamic groups configured in the local domain (i.e. the domain whose profile is
/etc/opt/ldapux/ldapux_profile.ldif), LDAP-UX will return dynamic members
for getgrnam()/getgrgid()/getgrent(), and return dynamic groups that a user belongs
to.
• For dynamic groups configured in remote domains (i.e. those domains whose profiles are
in the directory /etc/opt/ldapux/domain_profiles), LDAP-UX will return dynamic
members for getgrnam()/getgrgid(), but not getgrent(). This is because LDAP-UX
does not support data enumeration with remote domains. When returning groups that a
user belongs to, LDAP-UX returns only those groups in the local domain (including static
and dynamic groups), but not groups in remote domains.
Dynamic Group with Active Directory Server Multiple Domains 89