Subject: Re: [ldapext] Nested group

From: "Liben, Michael \(GTI\)" <[email-masked]>
Date: Thu, 20 Sep 2007 13:24:25 -0400

Regardless of the implementation (which is not visible from the interface), the memberOf attribute contains a list of group and groupOfNames objects of which the object is a member. The server maintains the integrity of the respective member and memberOf attribute values when objects are added, moved or deleted.

This makes it simple toi answer the question, "of what groups is the object a member?" 

--------------------------
Sent from Michael Liben's wireless handheld

-----Original Message-----
From: Luke Howard <[email-masked]>
To: Liben, Michael (GTI)
CC: simo <[email-masked]>; Howard Chu <[email-masked]>; [email-masked] <[email-masked]>
Sent: Thu Sep 20 00:44:59 2007
Subject: Re: [ldapext] Nested group

Liben, Michael (GTI) wrote:
> In Active Directory, Microsoft maintains 'back link' attributes. One of
> these is memberOf. When an object is added or removed from a group, a
> process runs that updates the back link attribute on the object. If the
> member object is moved or deleted, another process updates the group's
> member attribute accordingly. 
>   
This isn't quite correct. Linked references are maintained in a separate 
table in the DIB, and returned dynamically at search time. The 
background process you're referring to handles references (linked or 
not) to entries in non-local partitions.

-- Luke

-- 
www.padl.com | www.lukehoward.com
--------------------------------------------------------

This message w/attachments (message) may be privileged, confidential or proprietary, and if you are not an intended recipient, please notify the sender, do not use or share it and delete it. Unless specifically indicated, this message is not an offer to sell or a solicitation of any investment products or other financial product or service, an official confirmation of any transaction, or an official statement of Merrill Lynch. Subject to applicable law, Merrill Lynch may monitor, review and retain e-communications (EC) traveling through its networks/systems. The laws of the country of each sender/recipient may impact the handling of EC, and EC may be archived, supervised and produced in countries other than the country in which you are located. This message cannot be guaranteed to be secure or error-free. This message is subject to terms available at the following link: http://www.ml.com/e-communications_terms/. By messaging with Merrill Lynch you consent to the foregoing.
--------------------------------------------------------
_______________________________________________
Ldapext mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ldapext

---

From: Luke Howard <[email-masked]>
Date: Fri, 21 Sep 2007 09:11:06 +1000

> This makes it simple toi answer the question, "of what groups is the 
Not entirely, because it does not answer this question with respect to 
transitive memberships.

-- Luke

---

From: "Liben, Michael \(GTI\)" <[email-masked]>
Date: Thu, 20 Sep 2007 21:08:24 -0400

Recurse upward until parent group does not have memberOf attribute. 

-----Original Message-----
From: Luke Howard [mailto:[email-masked]] 
Sent: Thursday, September 20, 2007 7:11 PM
To: Liben, Michael (GTI)
Cc: [email-masked]; [email-masked]
Subject: Re: [ldapext] Nested group

-- Luke