--On Thursday, March 16, 2006 4:57 PM -0600 Dustin Puryear
<[EMAIL PROTECTED]> wrote:
I'm particularly interested in this discussion as it pertains to 1-person
N-accounts. That's what is truly tricky to me in a directory with a
significant number of entries supporting several applications. The simple
fact is that most locations are not on the 1-person 1-account rule, and
they
may never do this. So we have to figure out how to support 1-person
N-accounts.
Methods:
3. One person entry, multiple accounts under separate container
What I typically do is create a 1-N relationship in the tree like so:
You have a person entry that represents a physical person (e.g., via an HR
number) under ou=People. There are no dups here. One person, one entry.
That
person probably owns several accounts. We then put a single, default
account
under ou=Accounts for that Person. So we have:
This is essentially what we do.
We have a cn=people,dc=stanford,dc=edu tree. People only have a single
entry under that location. It contains all the information about people.
Then we have a cn=accounts,dc=stanford,dc=edu tree. It tracks all the
account information.
Your issues are a little more complex than at Stanford, it seems. I
basically have the following accounts:
quanah/root
quanah
quanah/admin
So "quanah" is my primary account. All 3 have separate passwords (as they
are used for different things). Right now, we don't really have anything
that uses the account information that also is going to be querying their
person information at the same time, so the linking isn't much of an issue.
You don't use things like quanah/root and quanah/admin to log into
applications. I can see that in an environment where people were allowed
multiple ID's, and would be using different ones in different locations,
things would be much more complex.
--Quanah
--
Quanah Gibson-Mount
Principal Software Developer
ITS/Shared Application Services
Stanford University
GnuPG Public Key: http://www.stanford.edu/~quanah/pgp.html
---
You are currently subscribed to [email protected] as: [EMAIL PROTECTED]
To unsubscribe send email to [EMAIL PROTECTED] with the word UNSUBSCRIBE as the
SUBJECT of the message.
