I usually use only DC tags for the root DN. For example:
I also match part of the root with the domain (in this case, it would be example.com). It is just a habit, it will not help or hinder your ability to use proxy accounts, for example.
Every LDAP enabled product I can think of allows you to specify the full DN of the path were your users are located. So the components you use don't matter as much as the structure itself (called the Directory Information Tree or DIT). You basically have to balance two things :
- A flat structure is future proof
- A deeply nested structure allows greater control (delegation, segregation of users)
A flat DIT, where for example all users would be under :
Will fit whatever organisational structure you have to work against. But you will sacrifice some ability to segregate users between applications using your LDS.
Here is an example. If you have two applications, you could have :
But what will happen if a user from
Application_A wants to use
Application_B ? Same goes for groups :
In short, don't worry about components, but give some thought about how well your DIT will fit in different reuse scenario.