Question

I was just wondering, for an LDAP structure, would it be possible for a group to have an organizational unit as a member? Or am I pretty much guaranteed that anything under a group object will either be a user or another group?

Also are the following guaranteed?

1) The parent of a user is either a group or organizational unit
2) The parent of a group is either a group or organizational unit
3) The parent of an organizational unit is a organizational unit or the root

Thanks, I’m still pretty new to LDAP.

Answer 1

Using the groupOfUniqueNames objectClass, the optional multi-valued attribute uniqueMember may be any valid distinguished name, including a distinguished name where the any or all of the RDN components are ou or organizationalUnit.

see also

• RFC4519

note that some implementations of groupOfUniqueNames require uniqueMember, and others do not.