Gruppen in Gruppen

[TMC]

Gibt es eigentlich Probleme (ACL, etc.) wenn im NAB Gruppen in Gruppen enthalten sind?

Beispiel:
Gruppe: "Formel1"
Diese enthält die Gruppe "Ferrari".
In der Gruppe "Ferrari" stehen die beiden Fahrer Schuhmacher und Barrichello.

Hat man irgendwelche Einschränkungen (z.B. in der ACL), verschachtelte Gruppen zu verwenden, also z.B. "Formel1" ?
Oder wird das komplett aufgelöst?

Matthias

[Glombi]

Da gibt es nur eine Einschränkunbg bzgl. der Verschachtelungstiefe - ich glaube maximal 9. Aber das müsste ich mal checken...
Ansonsten gibt es keine Problemchen.

Aus der KBASE:
In R5, the limit on nesting groups has been increased from six (6) to twenty (20).

In R6 gilt:

Problem
What are the limits on nesting groups for mail routing in Domino 6?

The short answer:

On the server, there are none.

The more detailed answer:

In R5, there was a limitation of 20 nested groups.  In the Notes 6 Client (or more specifically, the Mailer), the limitation still exists and attempting to route a message to a group nested over 20 levels results in the following error:

"Groups cannot be nested more than 20 levels deep when mailing."

In the Domino 6 server, however, there have been improvements to the group expansion algorithm so that there is no longer a limit.

Supporting Information:

The reason for the limitation in R5 was to prevent infinite loops during the group expansion routine.  Domino 6 now effectively removes duplicate and looping group names from the expansion.

Clients are able to route to groups in the public Name & Address Book (NAB) over 20 levels deep if they append the local domain name to the end of the group name (for example, "To: SuperLargeNestedGroup@LocalDomain").  This leaves the group expansion task to the Domino Router.

Allowing functionality for the Mailer to handle groups the way the Router does has been reported to Lotus Software Quality Engineering in the form of an enhancement request, and is being considered.

Related Documents:

"Groups Cannot Be Nested More Than 20 Levels Deep When Mailing" - Limits on Nesting Groups in R5
Document #: 179797  


Andreas

[TMC]

Danke, Andreas !

Wenn ansonsten keine Einschränkungen (auch nicht an anderen Stellen wie Leserfelder etc.) bekannt sind: prima  

[koehlerbv]

Keine Risiken und Nebenwirkungen - kann ich auch nur bestätigen.

Bernhard

[TMC]

Merci für die Bestätigung, Bernhard

Und das nächste Mal schreibe ich auch den mehrmaligen Formel1-Weltmeister richtig in meinen Beispielen, auch wenn er bestimmt genug verdient, um sich ein "h" zu kaufen  

[Glombi]

Dann gibt es noch das tolle WebSphere:

WebSphere Application Server does not support nested groups within LTPA.  LDAP allows groups to contain groups as members and will search through the second level of that group to find individual names and authenticate the user.  WebSphere's mechanism for determining group membership finds all groups for which member attributes exist for the users.  It does not look for nested groups.

Aber das ist eine andere Baustelle... (so auf Notes 1.0 Niveau  )

Andreas

[Glombi]

In 5.0.4 wurden Nested Groups nicht korrekt aufgedröselt - behoben in 5.0.5.

[MOD]

Die Größe der Gruppen wird (irgendwann) entscheidend sein. In deinem o.g. Beispiel kein Problem. Sollten die verschachtelten Gruppen jedoch umfangreicher sein, sollte die 32 Bedingung berücksichtigt werden. Eine Berechnungsgrundlage gibt es bei IBM.

  MOD

[koehlerbv]

Oh ja - MOD hat wahr, die 32k müssen berücksichtigt werden. Spätestens bei eigener (rekursiver) Auflösung knallt es sonst.
AFAIK ist es jedoch problemfrei, für ACL- und Mail-Gruppen an sich Namenseinträge durch nested groups zu generieren, die dann über die 32k-Grenze gehen.

Bernhard

[Glombi]

Dazu aus der KBASE:

Size Limits on Nested and Expanded Groups in Domino

Problem:

A customer sends a message to a group (say, Company_All) that has several nested groups.  The router reports the following:

Router: Unable to deliver message 005E986D, 005E5389 to Company_All @ Domain
Router: Unable to deliver message 005E986D, 005E5389 to Nested_Group1 @ Domain
Router: Unable to deliver message 005E986D, 005E5389 to Nested_Group2 @ Domain

etc....


The message is then purged from MAIL.BOX.  No one gets the message, no delivery failures are generated, and the message does not show up as Dead in MAIL.BOX.

Solution:

This is due to a limitation the Router process has with group sizes.  The total size of an expanded group is limited to 32KB (or 32768 bytes).

Calculating the group length:

The length of an expanded group incorporates the following variables:

the length (in bytes) of the group name
the length of all of the sub-group names
for each group, the length of the domain name + 1 (add one to incorporate the use of "@" when the group is stored in memory)
overhead in bytes, which equals 4 + 2*(total number of groups and subgroups)

Example 1:

   Group name: TestGroup
   Domain name: TestDomain
   Group members: User1, User2, User3
   
   The total length of this group = length(TestGroup) + (length(TestDomain) + 1)+ 4 + 2*1
               = 9 + 10 + 1 + 4 + 2
               = 26 bytes

Example 2:

   Group name: TestGroup2
   Domain name: TestDomain
   Group members: User1, User2, User3, TestGroup3, TestGroup4
      (TestGroup4 contains another group called TestGroup5)

   Total length = length(TestGroup2) + (length(TestDomain) + 1)
         + length(TestGroup3) + (length(TestDomain) + 1)
         + length(TestGroup4) + (length(TestDomain) + 1)
         + length(TestGroup5) + (length(TestDomain) + 1)
         + 4 + 2*4
   Total length = 10 + 11
         + 10 + 11
         + 10 + 11
         + 10 + 11
         + 4 + 8
      = 96 bytes


Ways to avoid hitting the limitation:

The best way to avoid hitting this limitation is to keep the length of each group name as short as possible.

Also, 32K is actually fairly hard to hit unless there are several groups with extremely long names (over 20 characters, for instance).  As an example, this scenario would hit the limit:

   Domain name: 10 characters long (which counts for 11 bytes added to each group name)
   Number of groups and subgroups: 1000
   Length of each group (in characters/bytes): 20

   Total group length: (20 + 11) * 1000
            + 4 + 2*1000
         = 33,004 bytes

Andreas