fuser9bb@hotpop.com wrote:
I want to create a set of groups that will be used for authorization purposes. To me, it seems that a groupOfNames or groupOfUniqueNames will best serve this purpose. (Better suggestions?) However, both object classes require at least one member attribute. There will be times though when a member is not known. How do you handle this?
Right now I create all groups with an invalid member attribute:
member: cn=invalid,dc=..,dc=..
Does this break any convention? Is there a better way to handle this?
There's nothing wrong with what you suggest. I would ignore groupOfUniqueNames, it's rather useless in the LDAP context. Note that it is legal for distinguishedName syntax to have a zero-length value. I would just use groupOfNames with a zero-length member, which is fundamentally the same idea as your using an invalid DN.
-- -- Howard Chu Chief Architect, Symas Corp. Director, Highland Sun http://www.symas.com http://highlandsun.com/hyc Symas: Premier OpenSource Development and Support