Group evaluation extended operation

Edit online

The group evaluation extended operation explains its use with the server and provides the results.

Description
The Group evaluation extended operation requests that the server return the set of groups to which the requested user belongs.
Note: This extended operation is always enabled.
Request
OID
1.3.18.0.2.12.50
Syntax
GroupEvaluationRequestValue:: = SEQUENCE  {
	   dn		LDAPDN,
                attributes	AttributeList  OPTIONAL
}
Response
OID
1.3.18.0.2.12.52
Syntax
Group ::= SEQUENCE { groupName LDAPString }
GroupEvaluationResponseValue :: = SEQUENCE{ 
      normalized  INTEGER{unnormzlied(0), normalized(1)};
      Sequence of Group }
Behavior
This extended operation determines to which groups the requested user belongs.
The following persons are enabled to call the extended operation:
  • Primary Directory Administrator
  • Local Administration Group members with DirDataAdmin role
  • Global Administrators
Note: If the extended operation is called by a user who does not have access, LDAP_INSUFFICIENT_ACCESS is returned.
This control has the following possible return codes:
  • LDAP_SUCCESS
  • LDAP_NO_MEMORY
  • LDAP_OPERATIONS_ERROR
  • LDAP_INVALID_DN_SYNTAX
  • LDAP_NO_RESULTS_RETURNED
  • LDAP_PROTOCAL_ERROR
  • LDAP_NO_SUCH_ATTRIBUTE
This extended operation is not supported by the Administration Server.
Scope
The extended operation affects only the current operation.
Auditing
The group evaluation extended operation sets the audit string to 
DN: the DN sent in the group evaluation extended operation \n
If ibm-auditAttributesOnGroupEvalOp is TRUE, the audit string contains a list of attribute value pairs that are separated by a new line. If the ibm-auditAttributesOnGroupEvalOp is FALSE, the string contains: 
sentAttrs: true|false
The value is FALSE if no attributes were sent on the request.