Blueprint changed by John Pugh:
Whiteboard changed to:
dendrobates: This is a good idea, but I would like to see a community
discussion about DIT layout. i.e. the use of dc=example,dc=com, over
o=example.com. I have almost always used dc, but not for any good
reason.
ru: having DIT in any form is very important for corporations. this
feature can (in future) replace MS AD ecosystem.
koptein: DIT and ldap means not (mail-, directory, or other) domains.
dc=example,dc=com is for a domain, also o=example.com is a domain and
both aren't very good for a bigger company structure. One example - for
better clarification - i use .uk (or .de, nl, ...).
If you start with dc=example,dc=uk and your company grow up with another
location, say example.br, how can s/o layout this new structure. Same for
o=example.uk and o= or ou= or c= ... example.br? Always a new DIT for a new
location? The important thing is not the domain (whatever domain), is is the
name of the structure, the comany. So for one of the best (L)DAP implementation
(NDS or eDirectory) nearly everyone recomends an o=example -- without any com,
org, net, uk, br, ... and other locations (or parts of an comypnay like sales,
hr, stock, ...) are in the second level in the DIT, like ou=br.
LDAP is not only for users and groups, what about computers, DNS, DHCP,
Harddisk, Pools, Volumes (LVM), SoftwareRAID-Level, Rights,
Clusterconfiguration, Loadbalancing, Routing, RIP, BGP, Applications and many
more? Think bigger but start small.
ru: 2 koptein - And what to do if we have many companies at one
server(s)? just create o=MyCompany and o=AsteriskCompany and
o=AnotherOneCompany? What is the difference with dc=MyCompany,dc=com
and dc=AsteriskCompany,dc=com and dc=AnotherCompany,dc=com ? We need
some strategy for DIT with many locations / contries / companies.
2 all - From Ubuntu survey - it seems that Ubuntu server are usually
used by SOHO, and they do not use Ubuntu as directory server because of
lack DIT feature. For me it means that better to have DIT good for SOHO
and suitable for big companies. From my point DIT in Ubuntu is most
important feature in 9.04 release.
ru: is there any work with this blueprint? if not - may be use eBox as official
DIT for Ubuntu?
or may be Canonical do not want to create any competitor to their proprietary
Landscape. Is any ideas?
ivoks: let's break away from o=organization and dc=domain,dc=com.
Clearly, both are false thinking since, as ru said, this logic doesn't
cover more organizations under one 'o' or more domains under one 'dc'.
Let's start thinking about server as a top organization. So, instead
'o=Organization Name', let's do 'o=Server Name'. That way we could have
lots of organizations and lots of domains on the same server. We should
just follow the logic of setup. We setup domain/organization on server -
make the server top tree.
2009-04-29 ro: The implementation of a directory server is essential for
Linux business adoption of all sizes - from small to medium to large
enterprises. In the year 2009, central authentification should be
available out-of-the-box, especially for a distribution that wants to
conquer the (corporate) desktops and servers. There are a few good
implementations out there (Mandriva Directory Server, eBox) which might
inspire the work to be done in Ubuntu. An equivalent to Group Policies
is important too, but out of the scope for this spec. However, an LDAP
directory server is the foundation of all the other services built on
top of it, so let's try to get it ready for 9.10.
2009-04-30 ro: If you like to think in larger scales, have a look at
FreeIPA [http://freeipa.org/page/Main_Page]. It is an implementation by
Red Hat/Fedora which provides exactly what is proposed here plus many
things more. So not only centralized user/group authentication and
management, but also e.g. Group Policies and Single Sign-on. The nice
thing is, one if its main focuses is on usability and ease of
administration in conjunction with flexibility. Isn't that what we
sorely afflicted admins have been waiting for all the time? Btw, Bug
#259547 ([needs-packaging] FreeIPA) covers exactly this.
2009-04-30 jpugh: The entire reason for a directory is to organize
around your network. I disagree with ivoks view as having dc=server as
this setup would create unnecessary traversal for trivial items. The
logical setup is to allow a new directory installation to setup their
own DIT the way they want to vs dictating what ubuntu thinks they need.
Recommendations are ok and the standard since LDAP came on the horizon
in the mid-90's have not changed much because they work. Keep it simple,
because any relatively knowledgeable directory administrator will change
it to suit the business. What is needed is a default schema discussion
as the schema will dictate the ease of directory management.
Unfortunately openldap still requires restart to reset the schema. I
vote that we take the FreeIPA DIT and go
