Attribute group for user?

Question

Hi all,
We're trying to migrate user data from an LDAP server to Active Directory running on Windows Server 2012.    Besides users objects, there are multi-value attribute "groups" objects in the LDAP server and I've no idea how to migrate to
AD, e.g.
For user uid=123456 who is a student with double major, there exists 3 objects for this user:
1. the user object, contains: uid: 123456, name, contact, etc...
2. 1st major object, contains: uid: 123456, major: Mathematics, year of attention (2010), faculty: Science
3. 2nd major object, contains: uid: 123456, major: English, year of attention (2011), faculty, Arts
Would anyone please help?   Thanks a lot.
Regards
/ST Wong

Answer 1

So group objects can be a bear, primarily because a group can contain other groups in the AD world not sure about the LDAP server you are migrating from.
So the first thing I would do is map all attributes that are in use on the ldap server to a corresponding AD attribute, once that's done a script could be built to populate those.
This would also be true from the groups.
Groups need a User or Group distinguished name to add  to the members attribute.
So in your migration steps before the first user is migrated, I would create a corresponding group that matches the LDAP servers group. Then as you migrate them in what ever script or third part product you use would just add as a member to the pre-created
group. FIM can do this but can be cumbersome to use.
Another thing that needs to go into the planning in respect to groups is that security groups are only useful when they are used to apply permissions to something.
So looking at your example
UID does that correspond to the logon name in Active Directory - if so then the corresponding attribute would be sAMAccountName
Name could correspond to displayName in Active Directory
Contact would be dependent on the data that the field held
The Major objects seem like groups to me
So Group Name,cn, and sAMAccountAttribute would be something like Mathematics2010
Another attribute on the group object, maybe department would hold Science
A lot of this is dependent on what consumes the data and whether an attribute already exists, You can create attributes if they are needed but would recommend first mapping out between the 2 systems to see which ones fit and which ones do not.
I know that is vague but here is some links that will let you know which attributes are defined by default in Active Directory
User Objects (Broken up by DC OS version)
http://msdn.microsoft.com/en-us/library/ms683980(VS.85).aspx
Group Objects (Broken up by DC OS Version)
http://msdn.microsoft.com/en-us/library/ms682251(v=vs.85).aspx
As you do the mappings between systems it important to have the final picture in mind of how everything will work once the migration is complete. That way it will allow you to focus on the important things and leave the not so important things till later.
Hopefully that helps!