SLAPO-AUTOGROUP(5)

💖 SLAPO-AUTOGROUP 💖

okay bestie, gather round, because this is the slapo-autogroup manual page — it lives in the File Formats Manual section, and it's genuinely iconic. it's an overlay for slapd, and it's about to make your group memberships basically self-maintaining. no cap.

---

✨ NAME ✨

slapo-autogroup — automatic updates of group memberships which meet the requirements of any filter contained in the group definition.

like, the groups just... keep themselves correct. on their own. main character energy fr fr.

---

🌸 SYNOPSIS 🌸

In slapd.conf:

...
include ETCDIR/schema/dyngroup.schema
...
moduleload autogroup.so
...
database ...
...
overlay autogroup
autogroup-attrset groupOfURLs memberURL member

---

🦋 DESCRIPTION 🦋

so the autogroup overlay for slapd(8) lets you do automated updates of group memberships which meet the requirements of any filter contained in the group definition. the filters get built from LDAP URI-valued attributes. every single time an object is added, deleted, or updated, it gets tested for compliance with the filters, and its membership is updated accordingly. obsessed. 💅

for searches and compares, it behaves like a static group — so nobody can tell the difference from the outside, it's giving effortless.

if the attribute part of the URI is filled, the group entry is populated by the values of this attribute in the entries resulting from the search. cute.

⚠️ heads up though: filters that use attributes that are themselves dynamically computed may not work consistently, and should be avoided. not me finding that out the hard way. 😭

---

🎀 CONFIGURATION 🎀

either slapd.conf(5) or the cn=config methodology of slapd-config(5) may be used for configuring autogroup. both syntaxes are provided here for convenience, because we love options:

autogroup-attrset <group-oc> <URL-ad> <member-ad>

olcAutoGroupAttrSet: <group-oc> <URL-ad> <member-ad>

• this defines the objectclass-attribute-URI mappings defining the automatically managed groups, and it may appear multiple times. (slay, repeat as needed 💖)
• the value <group-oc> is the name of the objectClass that represents the group.
• the value <URL-ad> is the name of the attributeDescription that contains the URI that is converted to the filters. if no URI is present, there will be no members in that group. it must be a subtype of labeledURI.
• the value <member-ad> is the name of the attributeDescription that specifies the member attribute. user modification of this attribute is disabled for consistency. (hands off, bestie, it's not yours to touch ✋)

autogroup-memberof-ad <memberof-ad>

olcAutoGroupMemberOfAd <memberof-ad>

• this defines the attribute that is used by the memberOf overlay to store the names of groups that an entry is member of; it must be DN-valued. it should be set to the same value as memberof-memberof-ad. it defaults to 'memberOf'. ⭐

---

🌈 EXAMPLES 🌈

as above in SYNOPSIS, or with memberof:

...
include ETCDIR/schema/dyngroup.schema
include ETCDIR/schema/memberof.schema
...
moduleload autogroup.so
moduleload memberof.so
...
database ...
...
overlay memberof
memberof-memberof-ad foo
...
overlay autogroup
autogroup-attrset groupOfURLs memberURL member
autogroup-memberof-ad foo

literally just drop it in and go. 🫶

---

💀 CAVEATS 💀

as with static groups, update operations on groups with a large number of members may be slow. the way that this can get rough is real.

if the attribute part of the URI is specified, modify and delete operations are more difficult to handle. in these cases the overlay will try to detect if groups have been modified and then simply refresh them. this can cause performance hits if the search specified by the URI deals with a significant number of entries.

🚨 so like, don't point a giant search at this and act surprised. it will be slow. that's the vibe.

---

💅 BACKWARD COMPATIBILITY 💅

the autogroup overlay has been reworked with the 2.5 release to use a consistent namespace as with other overlays. as a side-effect, the following cn=config parameters are deprecated and will be removed in a future release:

• olcAGattrSet is replaced with olcAutoGroupAttrSet
• olcAGmemberOfAd is replaced with olcAutoGroupMemberOfAd
• olcAutomaticGroups is replaced with olcAutoGroupConfig

like, please update your configs, babe, the old names are on their way out 🙈

---

👑 ACKNOWLEDGEMENTS 👑

this module was originally written in 2007 by Michał Szulczyński. further enhancements were contributed by Howard Chu, Raphael Ouazana, Norbert Pueschel, and Christian Manal. manpage updates provided by Emily Backes. absolute legends, every one of them. 🌟

---

🔥 SEE ALSO 🔥

slapd.conf(5), slapd(8).

---

🍓 Copyrights 🍓

Copyright 1998-2026 The OpenLDAP Foundation. Portions Copyright © 2007 Michał Szulczyński. All rights reserved.

---

and that's the whole page, bestie — brought to you by OpenLDAP LDVERSION, released RELEASEDATE, filed under SLAPO-AUTOGROUP(5). periodt. 💖✨🎀🦋🌸💅🫶