LDAP-UX Client Services B.05.01 Administrator Guide for HP directory servers and Windows ADS

DC=com
msDS-AzLDAPQuery: (cn=p*)
To return dynamic members, LDAP-UX searches the tree dc=hp,dc=com, and finds the POSIX
entries whose cn starts with p* (that is, using the search filter
"(&(objectclass=user)(uidNumber=*)(cn=p*))" ).
6.4 Number of group members returned
With dynamic membership support, as with regular (static) group membership support, the number
of group members for a specific group returned by getgrnam()/getgrgid()/getgrent()
on an HP-UX system is limited by internal buffer sizes. On HP-UX 11i systems, the buffer size is
7296 bytes for 32-bit applications and 10496 bytes for 64-bit applications. This limitation is mainly
impacted by the size of each member name. For a detailed description, see the "Account and
Group Management" section in the Preparing your Directory for LDAP-UX Integration white paper
available at:
http://www.hp.com/go/hpux-security-docs
Click HP-UX LDAP-UX Integration Software.
During the login process, information for getting group members is not requested. The login time
is not affected by processing group members.
6.5 Number of groups returned for a specific user
When “ldap” is configured in the /etc/nsswitch.conf file as a data repository for the group
service (see nsswitch.conf(4)), if an LDAP user logs into an HP-UX system, LDAP-UX is involved to
return all groups that the user belongs to. The login application (such as login) initializes the
user's group access based on the group information returned by LDAP-UX.
Information for getting groups that a specific user belongs to is requested by LDAP-UX during login
via initgroups(). LDAP-UX returns at most 20 groups for a system limit on HP-UX 11i v2 systems.
On HP-UX 11i v3 systems, you can increase the number of groups a user may be a member of
(known as NGROUPS). For more information, see the Group membership expansion: guidelines
for deployment white paper at:
http://www.hp.com/go/hpux-core-docs (click HP-UX 11i v3)
If the user belongs to more than 20 groups, only the first 20 groups are returned. The support of
dynamic groups does not change the system limitation.
Depending on how you configure groups, if those 20 groups happens to be the last entries of
thousands of dynamic groups, the login time could be long and performance could be impacted.
Based on the configuration of memberUid attribute mappings, LDAP-UX might return static or
dynamic groups. The first memberUid mapped attribute determines if LDAP-UX returns static or
dynamic groups first. If the first memberUid mapped attribute is a static group attribute (such as
memberUid, member, or uniquemember), LDAP-UX returns static groups first. If there are less
than 20 static groups, LDAP-UX then returns dynamic groups for the rest groups. However, if the
first memberUid mapped attribute is a dynamic group attribute (such as memberURL,
nxSearchFilter, or msDS-AzLDAPQuery), LDAP-UX returns dynamic groups first. If there are
less than 20 dynamic groups, LDAP-UX then returns static groups for the rest groups.
With this design, a group containing both static and dynamic group attributes will always be
processed, but will be limited to the first 20 groups.
For example, if a user belongs to 8 static groups and 20 dynamic groups, and you map memberUid
to memberUid memberURL ( or to memberUid msDS-AzLDAPQuery ), LDAP-UX will return 8
static groups and 12 dynamic groups. If you map memberUid to memberURL memberUid,
LDAP-UX will return 20 dynamic groups without any static groups.
180 Dynamic group support