set dynamic-group Command

This command has the following format:

set dynamic-group [tag] = {

[subtree = DN]
objectclass = object-class
url-attr = attribute
member-attr = attribute

};

[subtree = DN]: This is optional: Specifies the dynamic-group-subtree to inspect for the specified baseObject, narrowing the search to only this sub-tree. This supports dynamic group membership search and compare requests without requiring set use-dynamic-roles = true;.
objectclass = object-class: Specifies that dynamic groups use the groupOfURLs object class.
url-attr = attribute: Specifies that the memberURL attribute stores the LDAP filter that defines the group membership.
member-attr = attribute: Specifies that the result of the LDAP filter in the memberURL attribute will be stored in the member attribute.

More information: