Table of Contents
Advertisement
Whatever you decide to use for an attribute-data pair for person entry RDNs, you
should make sure that they are unique, permanent values. Person entry RDNs
should also be readable. For example,
preferable to
uid=b12r56A, dc=example,dc=com
simplify some directory tasks, such as changing directory entries based on their
distinguished names. Also, some directory client applications assume that the
and
attributes use human-readable names.
cn
Considerations for Person Entries in a Hosted Environment
If a person is a subscriber to a service, the entry should be of object class
and the entry should contain the
a customer subtree.
If a person is part of the hosting organization, represent them as an
with the
nsManagedPerson
Placing Person Entries in the DIT
Here are some guidelines for placing people entries in your directory tree:
•
People in an enterprise should be located in the directory tree below the
organization's entry.
•
Subscribers to a hosting organization need to be below the
for the hosted organization.
Naming Group Entries
There are four main ways to represent a group:
•
A static group — The entry for this type of group uses the
groupOfUniqueNames
of the group. Static groups are suitable for groups with few members, such as
the group of directory administrators. Static groups are not suitable for groups
with thousands of members.
Static group entries must contain a
is a mandatory attribute of the
uniqueMember
This object class requires the
the group entry.
•
A member-based group — This type of group uses a
entry of each group member.
•
A dynamic group — This type of group uses an entry representing the group
with a search filter and subtree. Entries matching the filter are members of the
group.
uid=bjensen, dc=example,dc=com
attribute. The attribute must be unique within
uid
object class.
object class, which contains values naming the members
uniqueMember
attribute, which can be used to form the DN of
cn
Designing Your Directory Tree
because recognizable DNs
inetOrgPerson
ou=people
groupOfNames
attribute value because
groupOfUniqueNames
attribute in the
memberOf
Chapter 4
Designing the Directory Tree
is
uid
inetUser,
branch
or
object.
73
Advertisement
Table of Contents
