A single LDAP auth server for two companies

Question

I run the network for a small company (mycompany.com) with 10 software developers and a laboratory (thelab.org) with 5 scientists. But the total number of people is 12, as 3 of them work both for the lab and the company. In some sense, the lab is a subsidiary of the company.

Though there are two different domain names (with emails and JIDs in them), the lab and the company share a common server.

At some point we've decided to move the users to LDAP to run a slave LDAP replica at the office and have a centralized auth. That is not a problem if there was a single company, but with two of them I get stuck.

1. LDAP base: one or two?
2. LDAP base: dc-based or o/ou-based?
3. The way to distinguish users 'company/lab'? should we still use groups for that (we have users/groups in passwd/groups now)

On some PCs I would like to have all of them, but some will have to filter users (we are running Linux and some FreeBSD sometimes, so pam_ldapd is our choice)

And, I'll prefer to store sudoers info in LDAP also.

And, we are running Exim4 MTA + Dovecot LDA and it would be great they could automatically decide the domain-part if a single username is given (again, making them using LDAP is not a problem for a single company setup). Note that those people who work both for the company and the lab have both email addresses that actually map to a single maildir :)

Any recipes and ideas appreciated.

Answer 1

Ok here's how I would do it:

1. One LDAP base, always one LDAP base. Even if the suite of tools you're using supports multiple, somewhere along the lines you'll need to use something that doesn't. Disclaimer: I've never even tried.

2. I always use dc based now. It's much easier to remember and having a DNS structure which matches the LDAP structure just feels more intuitive for me. Saying that, I have had problems getting certificates issued in the past.

3. Two groups with some common members definately feels the right way forward.

As far as sudoers are concerned, on Linux I always just set up groups in the sudoers file and then add and manage the groups using LDAP. I know you can build sudo to use LDAP natively but it doesn't come like that on any of the platforms I use so I don't.

I've only played with exim and dovecot but I would set up both MX records to point at the same server and have users configure their from and reply-to addresses as they see fit.