ISMEMBEROF and Associated Group Records

Original author: Beth Mercer - 20081103

The isMemberOf is an attribute of the eduMember objectClass. The eduMember objectClass is granted to every ou=people directory record when created. isMemberOf is provisioned with individual group memberships that are in turn used by external applications to make authorization based decisions.

isMemberOf values are expected to tie to ou=group records of the same name although there is currently no mechanism within the directory that forces that relationship. So, it is currently possible to provision an isMemberOf value that matches no group name.

The mechanism by which ou=group records are created is the AUTHSERV Seed Group page:

​https://authserv.alaska.edu/cgi-bin/seed_group

That CGI script creates both the directory group record as well as a registry record to track the group.

The mechanism by which isMemberOf values are provisioned is presently ZUAUSR. However, ZUAUSR is an application that performs provisioning for administrative users which historically have been only employees and select vendors.

If/when the use of group records and the isMemberOf attribute is extended to serve a population of non-employees, then other mechanisms for provisioning will need to be created. When that comes to pass, it is recommended that different consituent groups be protected from each other's activities by creating security objects that scope access to group record creation and isMemberOf provisioning.

That can be accomplished as follows:

1) Create new EDIRrole values specific to particular applications/provisioning processes

EDIRrole: groupAdmin<pattern>

2) Create new iPlanet roles specific to each new EDIRrole

3) Create ACIs tied to the new iPlanet roles in which the scope of the access

is defined in a targattrfilters clause which limits access to group names beginning with <pattern>

EXAMPLE:

# EDIRrole value groupAdminAppA

#iPlanet role dn: cn=groupAdminAppARole,ou=people,dc=alaska,dc=edu objectclass: top objectclass: LDAPsubentry objectclass: nsRoleDefinition objectclass: nsComplexRoleDefinition objectclass: nsFilteredRoleDefinition cn: groupAdminAppARole nsRoleFilter: (&(EDIRROLE=*)(EDIRrole=groupAdminAppA)(eduPersonAffiliation=Employee)(assignmentCount=*)(!(assignmentCount=0))) Description: filtered role for entities allowed to define groups and provision membership for AppA

# ACI snippet for group record creation/deletion (targattrfilters="add=cn:(cn=appusers:AppA:*), del=cn:(cn=appusers:AppA:*)")

allow (compare,read,write,search) (roledn="ldap:///cn=groupAdminAppARole,ou=people,dc=alaska,dc=edu" and (ip="137.229.9.17

137.229.9.68

137.229.9.71

137.229.9.75"));)

# ACI snippet for isMemberOf updates (targattrfilters="add=isMemberOf:(isMemberOf=cn=appusers:AppA:*), del=isMemberOf:(isMemberOf=cn=appusers:AppA:*)")

allow (compare,read,write,search) (roledn="ldap:///cn=groupAdminAppARole,ou=people,dc=alaska,dc=edu" and (ip="137.229.9.17

137.229.9.68

137.229.9.71

137.229.9.75"));)

# pattern of group names and isMemberOf values to which ACIs apply cn=appusers:AppA:*,ou=group,dc=alaska,dc=edu

In the example, the assumption is still that group and isMemberOf maintenance for AppA is being delegated to a univeristy employee who's account can be provisioned via ZUAUSR. If instead responsibility is to be delegated to an application, then the iPlanet role needs to be stuctured for use by ou=resource records.

Should applications have a need to independently delgate group and isMemberOf maintenance for their own pattern of group names, then iPlanet roles should be created that rely on a specific isMemberOf values rather than EDIRrole values. Then who ever was granted a key isMemberOf value could in turn grant other users the same isMemberOf value, there by delgating group/isMemberOf maintenance authority.

NOTE: EDIRrole values can not be used to facilitate delegation of delegated authority as only users with EDIRadmin can provision EDIRrole values and EDIRadmin will NOT be granted to individuals managing group/isMemberOf for specific applications.

# eof