On Fri, 10 Mar 2006, Michael Smith wrote:
has anyone else on the list confronted a similar problem to ours -- namely
the multiple affiliation/multiple institution matrix?
The University of Tennessee has the same issue with multiple autonomous
campuses, although many fewer than CUNY.
We have five separate subtrees, under which we put our ou=People,
ou=Groups, etc. levels. This gives us the ability to provide write level
access to different campus trees to local IT staff via ACL. We put
employees into the appropriate subtree based on the primary payroll center
as specified in our, thankfully statewide, payroll system. Students, who
come from separate campus student systems, have a subtree chosen for them
based on some somewhat arbitrary rules that determine what campus is
likely their primary one, given that we don't get any kind of class hours
information.
We use uid as our rdn and centrally assign them for uniqueness across the
statewide tree, although our campuses can create their own algorithms for
coming up with the uid.
We are using eduPersonAffiliation (a multi-valued attribute) to reflect
multiple student/faculty/staff/etc affiliations and also
eduPersonPrimaryAffiliation (a single-valued attribute) to reflect, well,
their primary affiliation.
We have also added two locally-defined multi-valued attributes to reflect
multiple student campuses and multiple employee campuses. We have a few
applications that look at these attributes, rather than tree placement, or
in addition to tree placement, to verify access to a particular system.
And then, of course, there are all the stupid vendor solutions which want
to construct a dn from the rdn, rather than looking it up. These give us
fits.
Each campus has their own locally-defined objectclass into which they can
put whatever information they deem necessary. This also means we don't
have to fight over whose local telephone number is going into the
directory. They all can.
There's more to it, obviously, but that's the basic outline of our
solution to a knotty problem that's as much a political one as a technical
one.
Melissa Wauford
Computer Systems Support
[EMAIL PROTECTED]
---
You are currently subscribed to [email protected] as: [EMAIL PROTECTED]
To unsubscribe send email to [EMAIL PROTECTED] with the word UNSUBSCRIBE as the
SUBJECT of the message.
