I am currently running an OpenLDAP Server managing my Linux Users as posixaccount and posixgroup elements like so:
dn: cn=shellinger,ou=groups,dc=company,dc=com cn: shellinger gidNumber: 5001 objectClass: posixGroup objectClass: top dn: cn=shellinger,ou=people,dc=company,dc=com cn: Simon Hellinger uid: shellinger uidNumber: 5001 gidNumber: 5001 objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: person objectClass: posixAccount objectClass: shadowAccount objectClass: top ...
Right now, aside of primary groups, Linux Group membership is managed locally on each machine. This works but I think defeats the purpose of centralized user management.
What I think I want is to assign my users different sets of groups depending on what machine they log on. Generally my users have useful business on all my machines, so I believe log-in restrictions (based on the host or a certain group) are too coarse grained for my use case. I want to restrict what they can do on each machine, not if they can log in at all; and in my mindset that translates to what Linux groups they are in.
Also, these groups (and as such, permissions) can be vastly different for each user on each machine, a person with superuser permissions on one machine can be a regular user on the next.
In my layman terms this sounds like role-based group-assignment, but after throwing my whole LDAP vocabulary at Google and serverfault I still can't seem to get my head around this.
Summing it up, the questions are: Is my usecase valid? Am I going about this the right way? Should I manage Linux groups in LDAP at all?