Dynamic groups and nested group support (Version 5.1.1 or later)

Dynamic groups contain a group name and membership criteria:

• The group membership information is as current as the information on the user object.
• Manually maintaining members on the group object is not necessary.
• Dynamic groups are designed so application does not need a large amount of information from the directory to find out if someone is a member of a group.

Nested groups enable the creation of hierarchical relationships that are used to define inherited group membership. A nested group is defined as a child group entry whose distinguished name (DN) is referenced by a parent group entry attribute.

Dynamic and nested groups simplify WebSphere Application Server - Express security management and increase its effectiveness and flexibility. You only need to assign a larger parent group if all nested groups share the same privilege. Assigning a role to a single parent group simplifies the runtime authorization table.