We already know that groupOfUniqueNames is misleading and should be
avoided. The big problem with groupOfNames is that member is required. So
my first thought was a new groupOfMembers objectclass where member is
optional (MAY instead of MUST).
Along the way I was thinking that perhaps a different concept was needed
here, like setOfNames instead. The main thinking being:
sets implicitly have unique membership
sets may be empty
sets may be comprised of other sets
This presents a single solution to the whole static/dynamic/nested groups
mess: setOfReferences.
The (multivalued of course) "reference" attribute is a URI.
if it's in the form of a plain DN, then it is the DN of a single
member. if it's in the form of an absolute qualified URI (i.e., it begins
with a "ldap:///"; spec) then it dereferences the URI to derive the members.
For a nested group, you would use
ldap:///cn=foo,o=bar?reference?base
which would join (union) the values of the referenced entry's reference
attribute to this set.