Beginning with version 2 of the MLDAP ESM Module (available in Enterprise Server 2.3 and some hotfixes for Enterprise Server 2.2 Update 2), you can specify groups as members of other groups. This nested groups feature lets you add users to groups through a form of inheritance and create large user groups.
No special module configuration is required to use nested groups. To include group A in group B, simply add group A to the list of members for group B. In this case group B is known as a supergroup of group A. Users who belong to group A will now also belong to group B.
Nested groups are generally most useful when All-Groups Mode is enabled, but do not require it.
Nested groups may be useful for various purposes:
Not all ESF Administration features currently work correctly with nested groups. If you use nested groups, Micro Focus recommends administering them with the esfadmin command's ADDMEMBER and DELMEMBER sub-commands, or with LDAP tools operating directly on the LDAP repository, rather than using the MFDS graphical user interface. The LISTREFERENCES sub-command (and ESF Admin API function) does not currently show supergroup membership; that also means that the Referential Integrity Sample User Exit does not recognize that users belong to supergroups.
Group membership changes, including changes in how groups are nested, are recognized when a user signs on to a region for the first time after that region is started. You can also instruct the region to update its information about group membership by sending it an ESF update request using the MFDS administration user interface or the esfupdate command-line utility.
Assume Alice belongs to the PROJ1 group. We can add PROJ1 to the DEV group using the esfadmin command:
esfadmin options ADDMEMBER GROUP=DEV MEMBER="PROJ1 group"
Now Alice will belong to both PROJ1 and DEV.
The following LDIF fragment creates the AUDIT and FINANCE groups, and makes AUDIT part of FINANCE:
dn: cn=AUDIT,CN=Enterprise Server User Groups,CN=Micro Focus,CN=Program Data,DC=X changetype: add adminDisplayName: Audit group objectClass: microfocus-MFDS-Group microfocus-MFDS-UID: AUDIT description: ES auditors group dn: cn=FINANCE,CN=Enterprise Server User Groups,CN=Micro Focus,CN=Program Data,DC=X changetype: add adminDisplayName: Finance group objectClass: microfocus-MFDS-Group microfocus-MFDS-UID: FINANCE description: ES finance group microfocus-MFDS-Group-Member: AUDIT group