Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

i'm facing a strange LDAP configuration. Some admin, just created users as OU in OpenLDAP. To do it, the admin, changed some attributes in the OU like posixAccount, inetOrgPerson, organizationalPerson and person.. my question is what is the advantage to do it? It works, but i would like to know the drawbacks about it.

share|improve this question
up vote 1 down vote accepted

Creating users as container objects (assuming that is really what happened, as opposed to changing the naming attribute from cn= to ou=, which is basically a non-event) does have some interesting advantages.

There was a PBX system (I think Nortel, but I do not recall now) that when it used LDAP for storing users and phone info it created the users as container objects.

This breaks all sorts of things but the gain is that the User object can contain configuration objects. This allows a different logical grouping than is usually handled.

Instead of adding attributes for configuration, or assigning the equivalence of group membership to some configuration object, it lets you store the configuration as objects.

I think Citrix has an approach where it does this as well, to store some personalized settings.

share|improve this answer

For one thing, the OU (organizationalUnit) doesn't have the shadowAccount objectClass, for expiring passwords/accounts, etc.

Where as, with a regular account, you get all the attributes that go with each of these objectClasses: person ,organizationalPerson, inetOrgPerson, posixAccount, shadowAccount

These are defined in: /etc/openldap/schema/

Can you describe your environment a little more?

share|improve this answer
so you mean, that maybe create LDAP Users as OU are good to avoid to have the password shadow controls shadow expire, shadowmin, shadownmax and so on? – VP. May 28 '10 at 11:54

In a generic case, you can modify the schema as you want. It can be ou=john, user=john, unicorn=john, etc; but it is against convention. I'd say that the admin did nobody a favor.

share|improve this answer
i know that i can, i just want to know which advantages do i have doing it.. i cannot see any, but maybe i'm missing something. – VP. May 28 '10 at 11:54
There realy are no advantages. – Konrads Jun 2 '10 at 8:15

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.