Group attributes in classic RFC 2307 zones

There are two object classes for the group extension object created in the Groups sub-container of the zone: the serviceConnectionPoint object class and the posixAccount object class.

Group attribute Stored in Active Directory attribute

UnixName

cn:GroupName

For example:

cn:performx

GroupVersion

displayName:GroupVersion

This attribute determines compatibility between a group profile object and the Access manager console. The only valid value for this attribute is $CimsGroupVersion3.

For example:

displayName:$CimsGroupVersion3

Gid

gidNumber:value

For example:

gidNumber:458

ParentLink

managedBy:DN_ActiveDirectoryGroup

If the zone is a 2.x and 3.x compatible zone , you should set this attribute to the DN of the parent Active Directory group object.

For example:

managedBy:cn=interns,cn=users,dc=ice,dc=net

If the zone does not need to be compatible with older versions of Centrify software, you can use the keywords attribute and parentLink pseudo-attribute to specify the security identifier (SID) of the parent Active Directory group object.

For example:

keywords:parentLink:S-n-n-nn-nnn..

UnixEnabled

keywords:unix_enabled:value

For example:

keywords:unix_enabled:True

ForeignForest

keywords:foreign:value

This attribute indicates whether a group in a zone is from an external forest.

For example:

keywords:foreign:False

Note:   The posixGroup group membership attributes are not set. Centrify uses the normal Active Directory mechanism for determining group membership.