Examples

You can refer to the examples provided here to work with the entries in dynamic group.

A single entry in which the scope defaults to sub and the filter defaults to objectclass=*:

ldap:///cn=John Doe, cn=Employees, o=Acme, c=US

All entries that are one-level below cn=Employees, and the filter defaults to objectclass=*:

ldap:///cn=Employees, o=Acme, c=US??one

All entries that are under o=Acme with the objectclass=person:

ldap:///o=Acme, c=US??sub?objectclass=person

Depending on the object classes to define user entries, the entries may not contain attributes, which are appropriate for determining group membership. You can use the auxiliary object class, ibm-dynamicMember, to extend your user entries to include the ibm-group attribute. This attribute allows you to add arbitrary values to your user entries to serve as targets for the filters of your dynamic groups.

For example: The members of this dynamic group are entries directly under the cn=users, ou=Austin entry that have an ibm-group attribute of GROUP1:

dn: cn=GROUP1,ou=Austin
 objectclass: groupOfURLs
 cn: GROUP1
 memberURL: ldap:///cn=users,ou=Austin??one?(ibm-group=GROUP1)

Here is an example member of cn=GROUP1,ou=Austin:

dn: cn=Group 1 member, cn=users, ou=austin
 objectclass: person
 objectclass: ibm-dynamicMember
 cn: Group 1 member
 sn: member
 userpassword: memberpassword
 ibm-group: GROUP1