Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

does anybody can tell me about best practice to model RBAC on LDAP ? I'm very confused, not sure if I should think about LDAP groups as role, or just user in some custom OU.

Any real-life examples with tasks-operations\roles\user scheme (one user, multiple roles per user, multiple operations-tasks per role) ?

BTW:Target systems are .net, java and iSeries

share|improve this question

LDAP is a protocol between the client and the data store. How you store the data is determined by how you define the schema, which usually contains objectClasses and attributetypes. You can also define your custom schema, which can make use of attributes from standardized schemas, like userPassword attribute. Look for some existing solution the way pam_ldap and pam_nss is used for authentication on Unix; or design your own: (1) design schemas; (2) design a custom client, along with a configuration file that makes your life easier.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.