If the authorization check fails, the request is refused with an access forbidden response. Of course, the web interface tests attributes to see whether a requested change is authorized. A subset of these attributes is communicated to the synchronized NT and UNIX hosts. These attributes are mapped to groups on the remote hosts, and users on the hosts have group memberships. The account administration software on remote host executes native routines or scripts to create, delete, and alter users.
Special exits permit further customization of actions on the remote hosts.
The group management interface permits creating new groups, altering group characteristics and adding members to groups. Groups and group memberships all have an expiration date. At the expiration date, the group membership or group with all its memberships expires. A rule is specified by a server to determine authorization of a request an. In a sense, the rules are arbitrary and do not need to use the implied meaning of the group.