LDAP-UX Client Services B.04.15 with Microsoft Windows Active Directory Server Administrator's Guide (edition 8)

Number of Group Members Returned
With dynamic membership support, as with regular (static) group membership support, the
number of group members for a specific group returned by
getgrnam()/getgrgid()/getgrent() on an HP-UX system is limited by internal buffer
sizes. On HP-UX 11i v1 and v2 systems, the buffer size is 7296 bytes for 32bit applications and
10496 bytes for 64bit applications. This limitation is mainly impacted by the size of each member
name. For detailed description, refer to the Preparing your Directory for LDAP-UX Integration white
paper under the "Account and Group Management" collection available at the following web
site:
http://docs.hp.com/en/internet.html
During the login process, information for getting group members is not requested. The login
time will not be affected by processing group members.
Number of Groups Returned for a Specific User
When ldap is configured in the /etc/nsswitch.conf file as a data repository for the group
service (see nsswitch.conf(4)), if an LDAP user logs into an HP-UX system, LDAP-UX is
involved to return all groups that the user belongs to. The login application (e.g. login) initializes
the user's group access based on the group information returned by LDAP-UX.
Information for getting groups that a specific user belongs to is requested by LDAP-UX during
login via initgroups(). LDAP-UX returns at most 20 groups for a system limit on HP-UX 11i
v1 and v2 systems. If the user belongs to more than 20 groups, only the first 20 groups are
returned. The support of dynamic groups does not change the system limitation.
Depending on how you configure groups, if those 20 groups happens to be the last entries of
thousands of dynamic groups, the login time could be long and performance could be impacted.
Based on the configuration of memberUid attribute mappings, LDAP-UX may return static
and/or dynamic groups. The first memberUid mapped attribute determines if LDAP-UX returns
static or dynamic groups first. If the first memberUid mapped attribute is a static group attribute
(such as memberUid or member). LDAP-UX returns static groups first. If there are less than 20
static groups, LDAP-UX then returns dynamic groups for the rest groups. On other hand, if the
first memberUid mapped attribute is a dynamic group attribute, msDS-AzLDAPQuery, LDAP-UX
returns dynamic groups first. If there are less than 20 dynamic groups, LDAP-UX then returns
static groups for the rest groups.
For example, if a user belongs to 8 static groups and 20 dynamic groups, and you map memberUid
to memberUid msDS-AzLDAPQuery , LDAP-UX will return 8 static groups and 12 dynamic
groups. If you map memberUid to msDS-AzLDAPQuery memberUid, LDAP-UX will return 20
dynamic groups without any static groups.
Number of Group Members Returned 87