Chuck Keagle said the following on 29/06/07 23:56: > I'm new to LDAP and starting to figure out the best Schema to define for > user accounts initially, and possibly Kerberos ACLs in the future. A > fixed width font would make this message more readable. > > Here are the requirements: > > ITAR/EARS requirement needs to know user's country of citizenship.
^^^^/^^^^ ???? > > Company Proprietary requirement needs to know employees and non-employees. > > Different types of computers (vector, scalar, & enclave) have different > sets of users. > > Thinking from the top down, I have come up with the following: > > c=us c=non_us > | | > -------------------- Similar to c=us tree > | | > p=company1Name p=company2Name ... > | > ----------------------------- > | | | > pu=vector pu=scalar pu=enclave > | | | > cn=John Doe cn=Joe Smith cn=Mary Ann > > Now, to set this up, I'm thinking the tree structure for citizenship and > company is OK, but what about defining them as attrubutes? That seems to > make the tree structure less complex. Is there an additional cost > associated of defining country and company as attributes? One benefit of having them as attributes is that you can just change those rather than moving a user into/out of a branch completely. A benefit of your chosen design would be if the ou=us is hit/searched heavier than say ou=uk, then you can have a distributed directory service: http://www.openldap.org/doc/admin23/referrals.html > > In this tree structure a typical user would be something like: > > dn: cn=John > Doe,ou=people,ou=scalar,ou=company,ou=us,dc=hpc,dc=example,dc=com > > Notice how many Organizational Units I put in the schema and how far down > I moved people. > > By moving people down so far, is there a way for one to only have one > entry if he/she has both vector and scalar accounts? vector and scalar > represent groups of host types. When a user has an account for that type, > he/she should have access to all hosts of that type. Or you could keep ou=company,ou=us,dc=hpc,dc=example,dc=com and have the computer account types as attributes. > Any additional thoughts here will be greatly appreciated. This is a > pretty big step for my first expenrience with LDAP. What kind of clients/apps are going to use this data? Consider that if you can, since you are designing your directory now and will probably already know the client side requirements. Many admins don't know this first. HTH. Gavin. -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E [EMAIL PROTECTED] Open Source. Open Solutions.(tm) http://www.suretecsystems.com/ --- You are currently subscribed to [EMAIL PROTECTED] as: [EMAIL PROTECTED] To unsubscribe send email to [EMAIL PROTECTED] with the word UNSUBSCRIBE as the SUBJECT of the message.
