Scott Bown wrote: > Hi, > > This is more of a general LDAP type question rather than a specific user > directory. I'm a bit of a newbie to LDAP. > > We have 6 extranet applications with a few more on the way. Currently > every uses from each client shares a joint client login. We need to > separate this and have individual logins for each user at each client. > > We're wanting to implement a LDAP Directory (OpenLDAP) to store User > information with the aim to using a web Single Sign On solution across the > current and future applications. > > We'll store the standard user details, username, name, email, address, > phone number. But we also need to store additional attributes, clientID > and a couple of other ID's. > > When new clients are added to backend database, using JLDAP we were > planning to generate a 'kind of' super user in the LDAP directory and > allow them via web frontend to create users under themselves. Theses sub > users would only be able to access the same applications as the super > user. The idea is to push the burden of user management onto the client. > Q1) Does that sound a sensible thing to do with LDAP? Or would using a > database table be more effective? > > We would like to implement access control, so the client super user can > say user1 can access application 1 but not application 2 and application > 3. I was thinking having attributes on each user something like > accessApp1=Y, accessApp1=N,accessApp1=N. Then checking for the attribute > when user attempts login. > Q2) is there a better way to implement customized access control. I > thought about user groups but thought i'd have to create a new group every > time I added a new application. > > My colleague suggested having the user information data stored in a > separate database and just use LDAP for username and password information. > Personally I think this adds another layer of complexity to the solution. > However manipulating the data in a database is easier than in the LDAP > directory. > Q3) Anyone have any opinions on this? > > Thanks for any advice or links to websites with good practices for LDAP > design. > > Scott
http://www.openldap.org/faq/data/cache/378.html http://blogs.sun.com/treydrake/entry/ldap_vs_relational_database http://blogs.sun.com/treydrake/entry/ldap_vs_relational_database_part -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E [EMAIL PROTECTED] Open Source. Open Solutions(tm). http://www.suretecsystems.com/ --- You are currently subscribed to [EMAIL PROTECTED] as: [EMAIL PROTECTED] To unsubscribe send email to [EMAIL PROTECTED] with the word UNSUBSCRIBE as the SUBJECT of the message.
