Locating a user's group memberships in Lightweight Directory Access Protocol

WebSphere Application Server security can be configured to search group memberships directly or indirectly. It can also be configured to search only a static group, or it can be configured to search static groups, recursive or nested groups, and dynamic groups for some Lightweight Directory Access Protocol (LDAP) servers.

Evaluate group memberships from user object directly: Several popular LDAP servers enable user objects to contain information about the groups to which they belong (such as Microsoft Active Directory Server, or eDirectory). Some user group memberships can be computable attributes from the user object (such as IBM Directory Server or Sun ONE directory server). In some LDAP servers, this attribute can be used to include a user's dynamic group memberships, nesting group memberships, and static group memberships to locate all group memberships from a single attribute.
For example, in IBM Directory Server all group memberships, including the static groups, dynamic groups, and nested groups, can be returned using the ibm-allGroups attribute. In Sun ONE, all roles, inculding managed roles, filtered roles, and nested roles, are calculated using the nsRole attribute. If an LDAP server has such an attribute in a User object to inculde dynamic groups, nested groups, and static groups, WebSphere Application Server security can be configured to use this attribute to support these groups.
Evaluate group memberships from a Group object indirectly: Some LDAP servers enable only Group objects, such as the Lotus Domino LDAP server to contain information about users. The LDAP server does not enable the User object to contain information about groups. For this type of LDAP server, group membership searches are performed by locating the user on the member list of groups. The member list evaluation is not currently used in the static group membership search for WebSphere Application Server.

Use the direct method for searching group memberships if your LDAP server such an attribute in the User object to include group information. To use the direct method or the indirect method, enter the appropriate value in the Group Member ID map field on the Advanced LDAP Settings panel using:

objectclass:attribute pairs for the indirect method
attribute:attribute pairs for the direct method

Sample entries of attribute:attribute pairs in Group Member ID map fields include:

ibm-allGroups:member for IBM Directory server
nsRole:nsRole for Sun ONE directory, if groups are created with role inside Sun ONE
memberOf:member in Microsoft Active Directory Server
groupMembership:member for eDirectory
Note: the groupMembership attribute lists all the static groups for which a user is a member. This attribute is NOT updated whenever an object matches or does not match a dynamic group's filter. Please refer to the Novell eDirectory documentation for more information about the groupMembership attribute.

Sample entries of objectClass:attribute pairs in the Group Member ID map field include:

dominoGroup:member for Lotus Domino
groupOfNames:member for eDirectory

While using the direct method, dynamic groups, recursive groups, and static groups can be returned as multiple values of a single attribute. For example, in IBM Directory Server all group memberships, including the static groups, dynamic groups, and nested groups, can be returned using the ibm-allGroups attribute. In Sun ONE, all roles, including managed roles, filtered roles, and nested roles, are calculated using the nsRole attribute. If an LDAP server can use the nsRole attribute, dynamic groups, nested groups, and static groups are all supported by WebSphere Application Server.

Some LDAP servers do not have recursive computing functionality. For example, although Microsoft Active Directory server has direct group search capability using the memberOf attribute, this attribute lists the groups beneath, which the group is directly nested only and does not contain the recursive list of the nested predecessors. The Lotus Domino LDAP server only supports the indirect method to locate the group memberships for a user. You cannot obtain recursive group memberships from a Domino server directly. For LDAP servers without recursive searching capability, WebSphere Application Server security provides a recursive function that is enabled by clicking Perform a Nested Group Search in the Advanced LDAP user registry settings. Select this option only if your LDAP server does not provide recursive searches and you want a recursive search.

Searchable topic ID: csec_directindirectldap