I run the network for a small company (mycompany.com) with 10 software developers and a laboratory (thelab.org) with 5 scientists. But the total number of people is 12, as 3 of them work both for the lab and the company. In some sense, the lab is a subsidiary of the company.
Though there are two different domain names (with emails and JIDs in them), the lab and the company share a common server.
At some point we've decided to move the users to LDAP to run a slave LDAP replica at the office and have a centralized auth. That is not a problem if there was a single company, but with two of them I get stuck.
- LDAP base: one or two?
- LDAP base: dc-based or o/ou-based?
- The way to distinguish users 'company/lab'? should we still use groups for that (we have users/groups in passwd/groups now)
On some PCs I would like to have all of them, but some will have to filter users (we are running Linux and some FreeBSD sometimes, so pam_ldapd is our choice)
And, I'll prefer to store sudoers info in LDAP also.
And, we are running Exim4 MTA + Dovecot LDA and it would be great they could automatically decide the domain-part if a single username is given (again, making them using LDAP is not a problem for a single company setup). Note that those people who work both for the company and the lab have both email addresses that actually map to a single maildir :)
Any recipes and ideas appreciated.