Description Michael Grandjean 2017-03-28 14:07:58 CEST

We should have an easy and failsafe way to tell if a group is a UCS@school class, a UCS@school workgroup or a plain UCS group. Currently, the only difference is their DN.

This makes it unnecessarily hard to fulfill a request (e.g. by an external application) like "show me all classes", because one has to iterate over all school OUs and then use "cn=klassen,cn=schueler,cn=groups,ou=${OU},${ldap_base}" as searchbase. 

Following the new objectClasses for UCS@school user roles, I suggest to also add objectClasses to the group types, e.g.:

UCS@school class → objectClass: ucsschoolClass
UCS@school workgroup → objectClass: ucsschoolWorkgroup

This way, a simple LDAP-Filter '(objectClass=ucsschoolClass)' would be enough for the request mentioned above.