LDAP-UX Client Services B.05.00 with Microsoft Windows Active Directory Server Administrator's Guide (obsolete beyond B.05.00)

5.3.2 Group attribute mappings
To enable the dynamic group feature support, you must run the setup program to remap the default
group attribute, memberuid, to the dynamic group attribute, msDS-AzLDAPQuery. If
msDS-AzLDAPQuery is not mapped to memberUid, LDAP-UX will not process dynamic groups.
The attribute mappings are done in step 23 of “Step 2: Run the setup program” (page 38) in
Section 2.4.5 (page 37).
Table 7 shows attribute mappings between the default group attribute and alternate group attributes
(assuming that the directory server is Windows 2003 R2 ADS):
Table 7 Attribute mappings
Static X.500 Group AttributeDynamic Group AttributeDefault Group Attribute
membermsDS-AzLDAPQuerymemberuid
5.4 Number of group members returned
With dynamic membership support, as with regular (static) group membership support, the number
of group members for a specific group returned by getgrnam()/getgrgid()/getgrent()
on an HP-UX system is limited by internal buffer sizes. On HP-UX 11i systems, the buffer size is
7296 bytes for 32-bit applications and 10496 bytes for 64-bit applications. This limitation is mainly
impacted by the size of each member name. For detailed description, refer to the Preparing your
Directory for LDAP-UX Integration white paper under the "Account and Group Management"
collection available at:
http://www.hp.com/go/hpux-security-docs (Click HP-UX LDAP-UX Integration Software)
During the login process, information for getting group members is not requested. The login time
will not be affected by processing group members.
5.5 Number of groups returned for a specific user
When ldap is configured in the /etc/nsswitch.conf file as a data repository for the group
service (see nsswitch.conf(4)), if an LDAP user logs into an HP-UX system, LDAP-UX is involved
to return all groups that the user belongs to. The login application (e.g. login) initializes the user's
group access based on the group information returned by LDAP-UX.
Information for getting groups that a specific user belongs to is requested by LDAP-UX during login
via initgroups(). LDAP-UX returns at most 20 groups for a system limit on HP-UX 11i v2 systems.
On HP-UX 11i v3 systems, you can increase the number of groups a user may be a member of
(known as NGROUPS). For more information, see the Group membership expansion: guidelines
for deployment white paper at:
http://www.hp.com/go/hpux-core-docs (click HP-UX 11i v3)
If the user belongs to more than 20 groups, only the first 20 groups are returned. The support of
dynamic groups does not change the system limitation.
Depending on how you configure groups, if those 20 groups happen to be the last entries of
thousands of dynamic groups, the login time could be long and performance could be impacted.
Based on the configuration of memberUid attribute mappings, LDAP-UX may return static and/or
dynamic groups. The first memberUid mapped attribute determines if LDAP-UX returns static or
dynamic groups first. If the first memberUid mapped attribute is a static group attribute (such as
memberUid or member). LDAP-UX returns static groups first. If there are less than 20 static groups,
LDAP-UX then returns dynamic groups for the rest groups. On other hand, if the first memberUid
mapped attribute is a dynamic group attribute, msDS-AzLDAPQuery, LDAP-UX returns dynamic
groups first. If there are less than 20 dynamic groups, LDAP-UX then returns static groups for the
rest groups.
80 Dynamic group support