Search code examples
ldap

Where are roles in LDAP?


If I look at a user entry in LDAP it has many attributes. One of them is memberOf which contains the groups the user is a member of.

What about roles?

Which attribute would normally contain roles assigned to the user?


Solution

  • LDAP in general doesn't have any concept of roles (much like SQL in general does not). That's specific to the LDAP server implementation that you're using – and often specific to each site's configuration, as even the same default schema for a particular product can be used in different ways.

    In most cases, roles are emulated via group memberships. This is usually stored on the group entry as a list of members, while memberOf is only a virtual attribute to show the inverse relationship.

    (Several different entry types can be used for groups, depending on system – LDAP groups might use 'groupOfNames' entries listing 'member' DNs; there is also a rarely used 'organizationalRole' object class with 'roleOccupant' attributes; LDAP servers that are used to hold system accounts can also have 'posixGroup' entries that represent a UNIX group.)

    If needed, though, custom attribute types can be added, but I don't remember there being a standard attribute that would represent roles.

    Storing roles directly as attributes on a user entry has the downside of making access control more complex – e.g. instead of granting rights to update a single "cn=Some Role" entry, the administrator needs to be granted rights to update a specific attribute on all current and future entries of a specific type, which can be much harder to express (e.g. I think in AD it would require mass-updating each user entry's ACL as well as tweaking the "default" ACL for the type?)