I administer a few servers for a small organization that offers ISP-like services to its members (webhosting, mail adressess on mutiple domains and associated IMAP accounts, Jabber accounts) and I want to centralize all account data in LDAP. I'm new to LDAP and now I need to design and organize the LDAP directory layout.
The biggest issue I'm struggeling with is how to map users to various accounts, e.g. single users currently have multiple IMAP and Jabber accounts which are associated with various addresses on various domains and each account has a different password and I need to retain that.
So how would I organize the LDAP directory layout?
Should users and various accounts be in different trees which are then linked through a common uid, i.e. ou=people,dc=example,dc=net with inetOrgPersons describing the user and then separate trees for the accounts such as ou=imapAccounts,dc=example,dc=net, ou=jabberAccounts,dc=example,dc=net etc. with custom schemas? Or is there a better way since this looks too much like solution using a relational database?
Any recommendations of resources/books/real world examples that are helpful here? Most resources that I've seen seem to assume that one person only has one mail/jabber account etc. and wants to use a single passwords for that. I can't believe it is that uncommon for ISPs to allow their customers to have multiple accounts e.g. in order to allow them to seperate private and work mails or to encourage different passwords for different services so that a saved Jabber password that gets compromised does not result in a compromise of all other services of that customer etc.
I'll try to be more specific about my use case and explain my current data model:
There are unique users which are persons for which I need some contact data and which have a (single) shell account on the webhosting box. Each of these unique users may have multiple IMAP and Jabber accounts.
To answer the design questions:
- A user could be considered a container for accounts, but it also represents a person which must have contact data associated with them.
- Users will never share accounts.
- Accounts will never move between users.
- The boxes run RHEL6 and I need integration with PAM, Postfix/Dovecot, and ejabberd so integration should be possible with both LDAP and a RDB.