Creating a proxy authorization group by using the command line

Edit online

You can use the command line to create a proxy authorization group. By using the proxy authorization mechanism, a client application can bind to the directory with its own identity. However, the application is allowed to run operations on behalf of another user to access the target directory.

Procedure

To create the proxy authorization group with an initial member in the cn=localhost location, run the following command:

idsldapadd -D adminDN -w adminPW -i 
filename

Where filename contains the following information:

dn: cn=proxyGroup,cn=localhost
cn: proxyGroup
member:cn=client1, ou=austin, o=sample
objectclass: top
objectclass: container
objectclass: groupOfNames
objectclass: ibm-proxyGroup

To add an another member, run the command:
```
idsldapmodify -D adminDN -w adminPW -i 
filename
```
Where filename contains the following information:
```
dn: cn=proxyGroup,cn=localhost
cn: proxyGroup
changetype: modify
add: member
member:cn=client2, ou=austin, o=sample
```
The proxy authorization function is utilized by including the Proxy Authorization Control with your LDAP operations or by using the LDAP commands with the -y option. For example:
```
idsldapsearch -D "cn=client1,ou=austin,o=sample" -w <client1password> 
-y "cn=userA,o=sample" -b "o=sample" -s sub ou=austin 
```
Based on the idsldapsearch specification, client1 can read from the target directories whatever userA has permission to read.