NAME

       slapo-autogroup  -  automatic  updates of group memberships which meet the requirements of
       any filter contained in the group definition.

SYNOPSIS

       In slapd.conf:
        ...
        include ETCDIR/schema/dyngroup.schema
        ...
        moduleload autogroup.so
        ...
        database ...
        ...
        overlay autogroup
        autogroup-attrset groupOfURLs memberURL member

DESCRIPTION

       The autogroup overlay to slapd(8) allows automated updates of group memberships which meet
       the  requirements  of  any filter contained in the group definition. The filters are built
       from LDAP URI-valued attributes. Any time an object is added/deleted/updated, it is tested
       for  compliance  with the filters, and its membership is accordingly updated. For searches
       and compares, it behaves like a static group.  If the attribute part of the URI is filled,
       the group entry is populated by the values of this attribute in the entries resulting from
       the search.

       Note that filters that use attributes that are themselves  dynamically  computed  may  not
       work consistently, and should be avoided.

CONFIGURATION

       Either  slapd.conf(5)  or  the  cn=config  methodology  of slapd-config(5) may be used for
       configuring autogroup.  Both syntaxes are provided here for convenience:

       autogroup-attrset <group-oc> <URL-ad> <member-ad>

       olcAutoGroupAttrSet: <group-oc> <URL-ad> <member-ad>
              This defines the  objectclass-attribute-URI  mappings  defining  the  automatically
              managed groups, and may appear multiple times.

              The value <group-oc> is the name of the objectClass that represents the group.

              The  value  <URL-ad>  is the name of the attributeDescription that contains the URI
              that is converted to the filters. If no URI is present, there will be no members in
              that group. It must be a subtype of labeledURI.

              The  value  <member-ad>  is the name of the attributeDescription that specifies the
              member attribute. User modification of this attribute is disabled for consistency.

       autogroup-memberof-ad <memberof-ad>

       olcAutoGroupMemberOfAd <memberof-ad>
              This defines the attribute that is used by the memberOf overlay to store the  names
              of groups that an entry is member of; it must be DN-valued. It should be set to the
              same value as memberof-memberof-ad. It defaults to 'memberOf'.

EXAMPLES

       As above in SYNOPSIS, or with memberof:

        ...
        include ETCDIR/schema/dyngroup.schema
        include ETCDIR/schema/memberof.schema
        ...
        moduleload autogroup.so
        moduleload memberof.so
        ...
        database ...
        ...
        overlay memberof
        memberof-memberof-ad foo
        ...
        overlay autogroup
        autogroup-attrset groupOfURLs memberURL member
        autogroup-memberof-ad foo

CAVEATS

       As with static groups, update operations on groups with a large number of members  may  be
       slow. If the attribute part of the URI is specified, modify and delete operations are more
       difficult to handle. In these cases the overlay will try to detect  if  groups  have  been
       modified  and  then  simply  refresh  them.  This can cause performance hits if the search
       specified by the URI deals with a significant number of entries.

BACKWARD COMPATIBILITY

       The autogroup overlay has been reworked with the 2.5 release to use a consistent namespace
       as with other overlays. As a side-effect the following cn=config parameters are deprecated
       and will be removed in a future release:

       • olcAGattrSet is replaced with olcAutoGroupAttrSet

       • olcAGmemberOfAd is replaced with olcAutoGroupMemberOfAd

       • olcAutomaticGroups is replaced with olcAutoGroupConfig

ACKNOWLEDGEMENTS

       This module was originally written in 2007 by Michał  Szulczyński.   Further  enhancements
       were  contributed  by  Howard Chu, Raphael Ouazana, Norbert Pueschel, and Christian Manal.
       Manpage updates provided by Emily Backes.

SEE ALSO

       slapd.conf(5), slapd(8).

Copyrights

       Copyright  1998-2024  The  OpenLDAP  Foundation.   Portions  Copyright   ©   2007   Michał
       Szulczyński.  All rights reserved.