<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
<body bgcolor="#FFFFFF" text="#000000">
We are close to getting Groups done in the SQL back end, but we
still need a schema for LDAP, and it is not super apparent how to
close the gap on it.<br>
<br>
<br>
The schema for role assignment is:<br>
<div class="container">
<div id="paste_border">
<pre class="paste_scroller"><div id="paste_container"><ol class="paste_lines"><li id="1" class="lineno"><div class="paste_content">#</div></li><li id="2" class="lineno"><div class="paste_content">olcObjectClasses: ( 2.5.6.8 NAME 'organizationalRole'</div></li><li id="3" class="lineno"><div class="paste_content"> DESC 'RFC2256: an organizational role'</div></li><li id="4" class="lineno"><div class="paste_content"> SUP top STRUCTURAL</div></li><li id="5" class="lineno special"><div class="paste_content"> MUST cn</div></li><li id="6" class="lineno"><div class="paste_content"> MAY ( x121Address $ registeredAddress $ destinationIndicator $</div></li><li id="7" class="lineno"><div class="paste_content"> preferredDeliveryMethod $ telexNumber $ teletexTerminalIdentifier $</div></li><li id="8" class="lineno"><div class="paste_content"> telephoneNumber $ internationaliSDNNumber $ facsimileTelephoneNumber $</div></li><li id="9" class="lineno"><div class="paste_content"> !
seeAlso $
roleOccupant $ preferredDeliveryMethod $ street $</div></li><li id="10" class="lineno special"><div class="paste_content"> postOfficeBox $ postalCode $ postalAddress $</div></li><li id="11" class="lineno"><div class="paste_content"> physicalDeliveryOfficeName $ ou $ st $ l $ description ) )</div></li></ol></div></pre>
</div>
</div>
<br>
And the users are in the roleOccupant field.<br>
<br>
We want to be able to make the roleOccupant included members of
groups. But I am not sure that having both in a single field is
advisable. I would rather have a deliberate fields for group
members. This was what we did in FreeIPA, and I think it is the
right approach.<br>
<br>
We could extend roleOccupant with an other object class, but there
is no obvious class to use.<br>
<br>
We could replace roleOccupant with a different object class. While
that would make a painful transition, it might be preferable. But
again, there is no obvious replacement.<br>
<br>
We could make groups a collection underneath organizationalRoles<br>
<br>
<br>
Feedback is welcome.<br>
</body>
</html>