I'm new to LDAP and starting to figure out the best Schema to define for
user accounts initially, and possibly Kerberos ACLs in the future. A
fixed width font would make this message more readable.
Here are the requirements:
ITAR/EARS requirement needs to know user's country of citizenship.
Company Proprietary requirement needs to know employees and non-employees.
Different types of computers (vector, scalar, & enclave) have different
sets of users.
Thinking from the top down, I have come up with the following:
c=us c=non_us
| |
-------------------- Similar to c=us tree
| |
p=company1Name p=company2Name ...
|
-----------------------------
| | |
pu=vector pu=scalar pu=enclave
| | |
cn=John Doe cn=Joe Smith cn=Mary Ann
Now, to set this up, I'm thinking the tree structure for citizenship and
company is OK, but what about defining them as attrubutes? That seems to
make the tree structure less complex. Is there an additional cost
associated of defining country and company as attributes?
In this tree structure a typical user would be something like:
dn: cn=John
Doe,ou=people,ou=scalar,ou=company,ou=us,dc=hpc,dc=example,dc=com
Notice how many Organizational Units I put in the schema and how far down
I moved people.
By moving people down so far, is there a way for one to only have one
entry if he/she has both vector and scalar accounts? vector and scalar
represent groups of host types. When a user has an account for that type,
he/she should have access to all hosts of that type.
Any additional thoughts here will be greatly appreciated. This is a
pretty big step for my first expenrience with LDAP.
Thank you.
---
You are currently subscribed to [EMAIL PROTECTED] as: [EMAIL PROTECTED]
To unsubscribe send email to [EMAIL PROTECTED] with the word UNSUBSCRIBE as the
SUBJECT of the message.
