LDAP-UX Client Services B.04.15 with Microsoft Windows Active Directory Server Administrator's Guide (edition 8)

Step 3: Setting Read Permissions for the Proxy User
The LDAP query groups (dynamic groups) created by Authorization Manager are not placed
under the CN=Users container. Authorization Manager creates its own authorization store
objects (for example, CN=dyngroup). By default, a regular user is not allowed to read LDAP
entries under those authorization store objects.
To support dynamic group feature with LDAP-UX, you must configure the proxy user to grant
the read permissions for those authorization store objects. Use the ADSI edit and execute following
procedures to grant the proxy user read permissions for a sample authorization store object,
CN=dyngroup, containing dynamic groups:
1. Start mmc from run to bring up console.
2. Add snap-in ADSI edit .
3. Connect to domain from Action.
4. Select the authorization store object, CN=dyngroup, and right-click on the properties
tab.
5. Click on the Security tab on the properties window.
6. Click on Add button on the Security window.
7. Add the proxy user and click on OK button.
8. On the permissions dialog box, select the Allow box for the read permission.
9. Click on the Advanced button on the Security window.
10. Select proxy user and click on the Edit button.
11. Choose the This object and all child objects selection from Apply onto drop
down list in the dialog box.
12. On the permissions dialog box, verify that the List Contents, Read All Properties
and Read Permissions selections are checked.
To support dynamic groups with LDAP-UX, you must configure the proxy user to grant the
read permissions for each authorization store object in Windows ADS. If you configure dynamic
groups more than one domain, the above procedures must be performed to every domain that
you want to support with LDAP-UX.
Multiple Group Attribute Mappings
LDAP-UX supports the dynamic group attribute, msDS-AzLDAPQuery, for Windows 2003 or
2003 R2 ADS.
By default, LDAP-UX uses the memberUid attribute to retrieve group members. With the support
of X.500 group member syntax, you can map the default group attribute, memberUid, to member
which you specify group members using user DNs. If you use Authorization Manager to create
dynamic groups for Windows 2003 or 2003 R2 ADS, LDAP-UX allows you to map memberUid
to msDS-AzLDAPQuery .
You can run the setup tool and map memberUid to multiple attributes as needed. For example,
the following output of /opt/ldapux/config/display_profile_cache shows that
memberUid is mapped to both static group attributes, memberUid and member, and the dynamic
group attribute, msDS-AzLDAPQuery (assuming that the LDAP directory server is Windows
2003 R2 ADS):
Group Service Configuration:
Attribute: is mapped to:
----------- -------------
name: cn
gid: gidnumber
members: memberuid msDS-AzLDAPQuery
member
84 Dynamic Group Support