Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

does anybody can tell me about best practice to model RBAC on LDAP ? I'm very confused, not sure if I should think about LDAP groups as role, or just user in some custom OU.

Any real-life examples with tasks-operations\roles\user scheme (one user, multiple roles per user, multiple operations-tasks per role) ?

BTW:Target systems are .net, java and iSeries

share|improve this question

1 Answer 1

LDAP is a protocol between the client and the data store. How you store the data is determined by how you define the schema, which usually contains objectClasses and attributetypes. You can also define your custom schema, which can make use of attributes from standardized schemas, like userPassword attribute. Look for some existing solution the way pam_ldap and pam_nss is used for authentication on Unix; or design your own: (1) design schemas; (2) design a custom client, along with a configuration file that makes your life easier.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.