groupOfNames

GroupOfNames is a standard LDAP/X.500 directory service object class used to represent a group as a collection of entries identified by their distinguished names (DNs). In LDAP schemas, an entry with the objectClass groupOfNames typically exposes the member attribute, which is multivalued and MUST be present. Each value of member is the DN of a directory entry that belongs to the group. The object class does not mandate a specific naming attribute for the group entry, though in practice many implementations name groups with a common name (cn).

Groups of this type are widely supported by RFC-based LDAP directories such as OpenLDAP and are used to model simple groupings where any directory entry can be a member. They contrast with groupOfUniqueNames, where the member attribute contains uniqueName values rather than DNs, or with more specialized group object classes used in various directory schemas.

Management is performed by LDAP modify operations on the member attribute, such as adding or removing values. There is no inherent notion of nested groups or inheritance beyond the membership values, although some servers provide extensions like a reverse memberOf operational attribute to facilitate reverse lookups.

Limitations include the fact that membership is expressed as DNs, so moving or renaming member entries can require updates to maintain valid references. Not all directory servers support reverse lookups or nested group semantics by default, and in environments like Microsoft Active Directory, the built-in group object class provides different semantics and capabilities. GroupOfNames remains a common choice for simple, interoperable group modeling in traditional LDAP and X.500-inspired directories.