up vote 3 down vote favorite
share [g+] share [fb]

I have ou=People and there I have stored our employees. I have to somehow divide them to our current employees and former employees. What I was thinking about was to create 2 groups, ou=Employees,ou=People and ou=FormerEmployees,ou=People but changing the entryDN of the uid seems to be a bit tricky...

Should I rather add a custom attribute, or create some group? What is the best practice?

link|improve this question
55% accept rate
feedback

4 Answers

up vote 2 down vote accepted

You could create a group and add them to that, but I think that moving them to a new OU is the best answer. Moving them to a separate OU performs your stated goal of 'dividing them into current employees and former employees'.

Additionally I would take these security precautions:

  • I would also take the precaution of changing their login shell to /bin/false

  • Note that you should change the password and mark the account as disabled. You could delete the passwd hash or replace it with something you would later recognize such as LOCK

These steps will prevent former employees from being able to log in, or if they were to somehow guess the password, do anything useful.

link|improve this answer
feedback
up vote 2 down vote

There is none. What we do is leave them in their last post and deactivate them.

link|improve this answer
1  
This - and maybe a group of "Ex Employees" that you could add them to. This would aid searching and, if you really wanted, you could add "DENY" permissions to them on sensitive things. It's really a matter of opinion, though - I've seen lots of methods, and they all work fine as long as everyone knows the procedure. – Dan Oct 31 '11 at 10:43
1  
We have a "Disabled" Staff OU that we move old employees into. Depending on their level on senority we'll keep them around for a while, or they'll get cleaned out after a whiled. – tombull89 Oct 31 '11 at 12:05
Any ideas how can I change effectively entryDN of some uid in openldap ? – John Oct 31 '11 at 17:42
feedback
up vote 1 down vote

In our Active Directory, we script this by disabling the account and moving it to a Terminated Employees OU. After 6mo in that OU they get deleted. It may be a lot of work to change each by hand, but that's what scripting is for.

link|improve this answer
That's a good policy, but AD actually provides a means to Disable users, where the OP tagged this question with "OpenLDAP", which sadly doesn't allow you to do that directly. – gWaldo Oct 31 '11 at 13:39
feedback
up vote 0 down vote

Moving the account entry outside of the default search base for accounts is a good practice.

If your user entries are leaves or you are using back_hdb in OpenLDAP, then you can use the ldapmodrdn command or ldap_rename() function in the LDAP API to move them. If they are subtrees, then you may have to recursively copy the subtree and then recursively delete it.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.