Group authorization control

Edit online

The Group authorization control explains its use with the server and provides the results.

Description
The Group Authorization Control enables a bound user to assert group membership. The server uses this set of groups in the evaluation of ACLs for the operation. The control was introduced as a tool for the proxy server. However, this control can be sent by any client.
Note: This control is always enabled.
OID
1.3.18.0.2.10.21
Syntax
Group ::= SEQUENCE { groupName LDAPString }
RequestValue :: = SEQUENCE{ 
    normalized     INTEGER{unnormzlied(0), normalized(1)};
    Sequence of Group 
}

The criticality must be set to TRUE to protect clients from submitting a request with an unauthorized identity.

Behavior
This control can operate independent of other controls. However, it is often sent with the Proxy Authorization Control. This control is registered for the following operations:
  • Any
  • Add
  • Bind
  • Compare
  • Delete
  • Extended Operations
  • Search
  • Modify
  • Modrdn
The following persons are enabled to send the control:
  • Primary Directory Administrator
  • Proxy Authorization Group members
  • Local Administration Group members
  • Global Administration Group members
Only Primary Directory Administrator and Local Administration Group members can assert group membership into the global administration group. Proxy group members and global administration group members do not have the authority to assert group membership into the global administration group.
Note: If the control is sent by a user who does not have access, LDAP_INSUFFICIENT_ACCESS is returned.
If more information is required for the control, and if an error is in the formatting of that information, then the following error returns might occur:
  • Missing information – LDAP_OPERATIONS_ERROR
  • Additional information – LDAP_OPERATIONS_ERROR
  • Invalid information – LDAP_OPERATIONS_ERROR
This control has the following possible return codes:
  • LDAP_INSUFFICIENT_ACCESS
  • LDAP_OPERATIONS_ERROR
This control is not supported by the Administration Server.
Scope
The control lasts for the term of one operation. Each operation treats the control the same. The operation is run with the assumption that the user is a member of the stated groups. This operation applies to all back-end servers.
Auditing
This control has a special flag to indicate whether more information must be audited. If the audit flag ibm-auditGroupsOnGroupControl is set to FALSE, then the control OID and criticality are only audited. If ibm-auditGroupsOnGroupControl is TRUE, then the following information is audited: 
controlType: control ID
criticality: {true | false}
Normalized: {true | false}
Group: group sent in request
Group: group sent in request
Group: group sent in request