Which group is a user member of ?

Question

Hi
I am using Iplanet 5.1. I have searched almost everywhere
for a solution for this :
How du you see which groups a user is member of ?
Hope one of you have the solution
Vh.
Finn

Answer 1

Dynamic group is not a group (I mean entry containing list of members) but an entry containing one ldap filter.
e.g. Mygroup (dynamic group) "contains" all users in Tokyo. ldap filter is (l=tokyo).
That's it. No member. Nothing but ldap filter.
As a result, if you want ot check ALL groups user belongs to, you will have to:
1 - retrieve user's DN.
2 - search all groups where uniquemember=[DN you retrieved]
3 - retrieve all ldap filters describing dynamic groups.
4 - check for each of them, if filter applies to user's entry. This can be done by either building the static group matching dynamic description and then compare uniquemember (can be VERY heavy) or by comparing filter against user's entry. Is location (l) = tokyo for this user ?
As you may understand, managing dynamic groups is not compatible with your request that is to retrieve all groups user belongs to. This is why - I suppose - version 5.x brings "roles". With roles, this information is stored within user's entry. This is easier for you. On the other hand, this is heavier if your goal is to retrieve all members of a given role. Nothing is perfect.
You do have to understand your goal and how you will manage it before deciding if you will use static groups, dynamic groups or roles (or most likelly, all of these features).
All have pros and cons.
Christian