[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: Dynamic Groups

"Dynamic Groups" is simply marketing blurb for attribute-based grouping. It's not more dynamic than so-called "static" group entries.

Howard Chu wrote: 
This definition would imply that Dynamic Groups are a concept that only
clients care about,

Yes and no. Some products simply use LDAP URLs for specifying attribute-based grouping which can be AFAIK resolved at the server's side for the server's authz scheme.

Won't LDAP eventually run into
a hard limitation, or a performance limitation, using attribute based
'dynamic
groups' as I described above due to the large number of
attributes that
could
potentially end up in a single entry?


No more so than if you defined a large number of static groups with lots of
entry DNs in their member attributes.


http://groups.google.com/groups?q=ldap+%22dynamic+groups%22&start=10&hl=en&lr=&ie=UTF-8&oe=UTF-8&selm=37A0D299.D41C679E%40ogre.com&rnum=14

IMO group entries do not scale well for many group members. I made some experiments with 70000 member attributes (OpenLDAP 2.0.x, 200000 members with Netscape DS 4.1x) but stopped evaluating it any further because it turned out to get quite slow. Also the group entries get quite large requiring a big cache and the first hit really costs time. No thorough analysis though.

Ciao, Michael.