OpenLDAP structure and user maintenance based on the roles

Question

I'm planning the structure of OpenLDAP server to integrate it with multiple applications(lets say 10 applications). In this I have 8 internal applications (Web and Mobile Applications) and 2 others say external services like GitLab.

Our scenario would be like using all the 10 applications with 1000 users. Among 1000 users there will be different roles like admin, managers,developers etc.

All the 1000 users will have permission/access to log into the applications(say cn=application3,cn=application4,cn=application5 as shown in picture).

For cn=application1 and cn=application2 (which are external services like GitLab and includes seperate roles as per in external application), only few users will have permission to access/use.

As per our requirement, we have inserted 1000 users in cn=group1. And in that we have moved few users into cn=application1 and cn=application2 who needs access to those applications. In future, my organization size will increase and number of applications will also increase. For now we are continuing with the structure as shown in picture. Is this best practice to follow?

Can anyone please guide me on how can I work out with this?? As I am newbie to OpenLDAP please let me know if I mentioned anything wrong.

Answer 1

Your layout looks strange.

• Typically users are kept in ou=users,dc=example,dc=com, ou=accounts,dc=example,dc=com or ou=people,dc=example,dc=com.
• Roles are generally considered to by a type of group (groupOfNames, groupOfUniqueNames or organizationalRole) and held in something like ou=groups,dc=example,dc=com. groupOfNames is most common.
• Consider naming your roles something like cn=admins+ou=app1,ou=groups,dc=example,dc=com. This will allow you to pull all roles for app1 by searching for ou=app1.