[gentoo-server] Advice for LDAP migration

[Kerin Millar]

Hi everyone,

I've been attempting to get to grips with LDAP with a view to migrating
away from NIS, and using it to support the various services I run
(notably Samba).

Now my network is not of a particularly large scale, nonetheless I want
to structure the directory according to some notion of order (and in
such a fashion as it would work well for a larger organisation too).

I've come up with a skeletal structure as follows:

dc=recruit2recruit,dc=net
	o=R2R
		ou = Clients
			(Address book entries for client contacts
                         go here)
		ou = IT
			(Unix/Samba accounts go here)
		ou = Sales
			(Unix/Samba accounts go here)
		
		ou = serve (name of the main server)
			ou = Machines
				(Samba3 machine accounts go here)
			ou = Groups
			ou = Hosts
			ou = Aliases
			...

	o=Some_other_company (or branch office?)
		...

So I'm using the 'o' entry to designate the company, with all
"top-level" organisation units for the company underneath of that.
Clients will contain simple address book entries (inetOrgPerson) for use
by email clients. Separate OUs exist for the departments which will
contain the actual user accounts (and will also have inetOrgPerson
attributes for use with email and anthing else that is necessary such as
qmail schema attributes).

The OU 'serve' refers to the hostname of my server, and I was thinking
of putting the Samba-3 machine accounts under the 'Machines' OU there,
and throwing all the other Unix related stuff in there (as ported by
PADL's migrationtools scripts ... POSIX groups, mail aliases and so
forth). I suppose it doesn't really need to be named after the server at
all, but that's a matter of cosmetics.

So, does this seem sensible? Perhaps I should make OUs for both
'Machines' and 'Accounts' under the OU for each department so that the
machines are associated with the department also? Maybe also, the
departmental information and address book related OUs should have parent
OUs to keep a potentially larger directory clean? Also, I want to ensure
that various entries can be found even if they are split accross OUs,
but I don't imagine that's a problem (presumably just refining the query
used by the various services in their capacity as an LDAP client if
necessary).

Any insights or additional advice will be gratefully received as I would
like to get this just so before fully populating the directory and
attempting to configure nss_ldap and such :)

Regards,

Kerin Francis Millar (kerframil)