If I look at a user entry in LDAP it has many attributes. One of them is memberOf which contains the groups the user is a member of.
What about roles?
Which attribute would normally contain roles assigned to the user?
LDAP in general doesn't have any concept of roles (much like SQL in general does not). That's specific to the LDAP server implementation that you're using – and often specific to each site's configuration, as even the same default schema for a particular product can be used in different ways.
In most cases, roles are emulated via group memberships. This is usually stored on the group entry as a list of members, while memberOf
is only a virtual attribute to show the inverse relationship.
(Several different entry types can be used for groups, depending on system – LDAP groups might use 'groupOfNames' entries listing 'member' DNs; there is also a rarely used 'organizationalRole' object class with 'roleOccupant' attributes; LDAP servers that are used to hold system accounts can also have 'posixGroup' entries that represent a UNIX group.)
If needed, though, custom attribute types can be added, but I don't remember there being a standard attribute that would represent roles.
Storing roles directly as attributes on a user entry has the downside of making access control more complex – e.g. instead of granting rights to update a single "cn=Some Role" entry, the administrator needs to be granted rights to update a specific attribute on all current and future entries of a specific type, which can be much harder to express (e.g. I think in AD it would require mass-updating each user entry's ACL as well as tweaking the "default" ACL for the type?)