什么是用于存储用户及其成员资格的好 Ldap ObjectClass

Question

I'm trying to create a Ldap schema for our users and groups (using ApacheDS but that should not matter)

Currently i have something like this

 (dc=company, dc=com)
   - ou : groups
      - GroupOfNames: cn=users
          -GON: cn subgroup A
              * member : uid = user1
      - GroupOfNames: cn=Admins
              * member : uid=admin

   - ou : users
       - InetOrgePerson uid="admin"
       - InetOrgePerson uid="user1"

Now the problem is I'm trying to connect a portal to use this schema for authentication/group membership.

The Portal wants the "user" to 'know' the groups it's member of (which is probably more efficient)

So I would need to have something like

- InetOrgePerson uid="admin"
    * memberOf : "cn=admin,cn=groups,cd=company,dc=com"

But inetOrgPerson does not allow any kind of memberOf attribute.... so my question is:

What kind of Ldap Object class can I use instead of inetOrgPerson that would allow a memberof attribute.

Answer 1

inetOrgPerson. You don't need a memberOf attribute. Just execute a search of the GroupOfNames 'member' attribute. This is how it is normally done.

Answer 2

Well, the server does matter. Since there is no standard for getting group membership in the users entry.

I don't know if Apache DS supports the "memberOf" attribute. OpenDJ (opendj.org) or OpenDS, SunDSEE do support it via the "isMemberOf" attribute (and could be configured to return either name).

The isMemberOf (or memberOf) is an operational attribute and thus must be explicitly requested in the search query.