Using active directory universal groups

When a Rational® ClearCase® community operating in a Microsoft® Active Directory environment includes users from multiple Active Directory domains that are part of the same forest, you can use an Active Directory universal group to provide users logged on to different domains with access to a common set of VOBs and views.

Note: If you are upgrading a multimaster Windows NT® domain environment to Active Directory, use the procedure in Converting proxy groups to convert the proxy groups to members of an Active Directory universal group.

To create an Active Directory universal group that can be used as the Rational ClearCase primary group by users from multiple Active Directory domains in a single forest:

Verify that the Active Directory environment is operating in native mode. (Universal groups cannot be created in an Active Directory domain that is operating in mixed mode.)
Create the Rational ClearCase users group as an Active Directory universal group.
Make each domain global group whose members are part of the Rational ClearCase community a member of the Rational ClearCase users group. Do not add individual user accounts to a universal group. Instead, group the users from each Active Directory domain into a domain global group defined in that domain, and make each of those groups a member of the universal group.
Require Rational ClearCase users to set CLEARCASE_PRIMARY_GROUP to the domain-qualified name of the (universal) Rational ClearCase users group. (You cannot use Active Directory account management tools to specify a universal group as a user’s primary group.)