This is great news.  The feedback I have after a quick read through (I
will try to put a bit more time on it later) would be to make the
'tennant' separation more flexible and why not use existing ldap

Instead of forcing the user into cn={TENANT},cn=tenants,$suffix why
not create a 'tennant' aux class that would allow the end user to
design a DIT however they would like.

We for example use o=<company|organization>,$suffix.  Then any schema
maintenance instead of being:
For each tennant in (cn=tenants,$suffix)
It would be:
For each tennant in (ldapsearch (objectclass=tennant))

Then the end provider could design a DIT that fit their needs with
replication in mind.  Consider the flexibility of:

o=<Tennant3>,OU=North America,$suffix

That's my 2ยข at the moment.  I'd be glad to banter back and forth
about this with you. :)


On Fri, Dec 16, 2011 at 5:35 AM, Adam Young <> wrote:
> I opened a ticket for multitenancy
> Here is a detailed write up of the issues.
> Please provide any feedback that you have and I will update.

Freeipa-users mailing list

Reply via email to