4.13. MemberOf Plug-in Attributes

Group membership is defined within group entries using attributes such as member. Searching for the member attribute makes it easy to list all of the members for the group. However, group membership is not reflected in the member's user entry, so it is impossible to tell to what groups a person belongs by looking at the user's entry.
The MemberOf Plug-in synchronizes the group membership in group members with the members' individual directory entries by identifying changes to a specific member attribute (such as member) in the group entry and then working back to write the membership changes over to a specific attribute in the members' user entries.

4.13.1. cn

Sets the name of the plug-in instance.
Parameter Description
Entry DN cn=MemberOf Plugin,cn=plugins,cn=config
Valid Values Any valid string
Default Value
Syntax DirectoryString
Example cn: Example MemberOf Plugin Instance

4.13.2. memberOfAllBackends

This attribute specifies whether to search the local suffix for user entries or all available suffixes. This can be desirable in directory trees where users may be distributed across multiple databases so that group membership is evaluated comprehensively and consistently.
Parameter Description
Entry DN cn=MemberOf Plugin,cn=plugins,cn=config
Valid Values on | off
Default Value off
Syntax DirectoryString
Example memberOfAllBackends: on

4.13.3. memberOfAttr

This attribute specifies the attribute in the user entry for the Directory Server to manage to reflect group membership. The MemberOf Plug-in generates the value of the attribute specified here in the directory entry for the member. There is a separate attribute for every group to which the user belongs.
Parameter Description
Entry DN cn=MemberOf Plugin,cn=plugins,cn=config
Valid Range Any Directory Server attribute
Default Value memberOf
Syntax DirectoryString
Example memberOfAttr: memberOf

4.13.4. memberOfAutoAddOC

To enable the memberOf plug-in to add the memberOf attribute to a user, the user object must contain an object class that allows this attribute. If an entry does not have an object class that allows the memberOf attribute then the memberOf plugin will automatically add the object class listed in the memberOfAutoAddOC parameter.
This setting does not require restarting the server to take effect.
Parameter Description
Entry DN cn=MemberOf Plugin,cn=plugins,cn=config
Valid Value Any Directory Server object class
Default Value nsMemberOf
Syntax DirectoryString
Example memberOfAutoAddOC: nsMemberOf

4.13.5. memberOfEntryScope

If you configured several back ends or multiple-nested suffixes, the multi-valued memberOfEntryScope parameter enables you to set what suffixes the MemberOf plug-in works on. If the parameter is not set, the plug-in works on all suffixes. The value set in the memberOfEntryScopeExcludeSubtree parameter has a higher priority than values set in memberOfEntryScope.
For further details, see the corresponding section in the Directory Server Administration Guide.
This setting does not require restarting the server to take effect.
Parameter Description
Entry DN cn=MemberOf Plugin,cn=plugins,cn=config
Valid Range Any Directory Server entry DN.
Default Value
Syntax DirectoryString
Example memberOfEntryScope: ou=people,dc=example,dc=com

4.13.6. memberOfEntryScopeExcludeSubtree

If you configured several back ends or multiple-nested suffixes, the multi-valued memberOfEntryScopeExcludeSubtree parameter enables you to set what suffixes the MemberOf plug-in excludes. The value set in the memberOfEntryScopeExcludeSubtree parameter has a higher priority than values set in memberOfEntryScope. If the scopes set in both parameters overlap, the MemberOf plug-in only works on the non-overlapping directory entries.
For further details, see the corresponding section in the Directory Server Administration Guide.
This setting does not require restarting the server to take effect.
Parameter Description
Entry DN cn=MemberOf Plugin,cn=plugins,cn=config
Valid Range Any Directory Server entry DN.
Default Value
Syntax DirectoryString
Example memberOfEntryScopeExcludeSubtree: ou=sample,dc=example,dc=com

4.13.7. memberOfGroupAttr

This attribute specifies the attribute in the group entry to use to identify the DNs of group members. By default, this is the member attribute, but it can be any membership-related attribute that contains a DN value, such as uniquemember or member.

Note

Any attribute can be used for the memberOfGroupAttr value, but the MemberOf Plug-in only works if the value of the target attribute contains the DN of the member entry. For example, the member attribute contains the DN of the member's user entry: 
member: uid=jsmith,ou=People,dc=example,dc=com
Some member-related attributes do not contain a DN, like the memberURL attribute. That attribute will not work as a value for memberOfGroupAttr. The memberURL value is a URL, and a non-DN value cannot work with the MemberOf Plug-in.
Parameter Description
Entry DN cn=MemberOf Plugin,cn=plugins,cn=config
Valid Range Any Directory Server attribute
Default Value member
Syntax DirectoryString
Example memberOfGroupAttr: member