0

does anybody can tell me about best practice to model RBAC on LDAP ? I'm very confused, not sure if I should think about LDAP groups as role, or just user in some custom OU.

Any real-life examples with tasks-operations\roles\user scheme (one user, multiple roles per user, multiple operations-tasks per role) ?

BTW:Target systems are .net, java and iSeries

Improve this question

1 Answer 1

Reset to default
1

LDAP is a protocol between the client and the data store. How you store the data is determined by how you define the schema, which usually contains objectClasses and attributetypes. You can also define your custom schema, which can make use of attributes from standardized schemas, like userPassword attribute. Look for some existing solution the way pam_ldap and pam_nss is used for authentication on Unix; or design your own: (1) design schemas; (2) design a custom client, along with a configuration file that makes your life easier.

Improve this answer

You must log in to answer this question.