Best practice for designing a directory tree

Question

Hello all,
I wanted to know what you all think about what is the best way to design a directory tree. Again it seems to me that experience makes the man perfect and I wanted to know what you all think about how to design directory tree model.
Here is my view; I believe that keeping at least Users/ Employee information flat make more sense to me. I know it’s a good idea that one should consider an organizational hierarchy when designing a tree. But there seems to be some problem too. If employee moves from one department to another within the same organization then directory administrator has to change the location/department of the user. However, if all users are under the same namespace i.e. ou=Users, administrator does not have to change or move users location in the directory to another location.
Also, while designing a directory there could be several hierarchy, one is organizational hierarchy another could be organizing user info based on job roles i.e. CEO->VPs-Managers->Consultant.... and so on so. So which one should consider. So by considering ou=Users namespace, we are avoiding risk on favoring one type of hierarchy.
The trade-off in using ou=Users a flat namespace is that browsing of the directory looks less interesting.
Anyway, this is my view, I would like to know your views too and hope this thread will help other in building their own directory Tree.
Thanks
Syed Suhail Ahmad

Answer 1

Honestly it really depends on what you need your system to do and how you want to handle administration. I have read the argument about keeping things simple with using ou=USERS and seems like the best situation for administration purposes. Currently my client is wanting all identity management to be handled in OID so I am in the process of doing our hierarchy also. I still have to explore the abilities of OID to see how I can set things up.
There are a few good books and websites that are good for referencing ldap. One book I use is LDAP Programming, Management, and Integration by Donley. For websites, just search on google or check out www.ldapguru.com or www.openldap.org(possibly).
Hope this helps a little. I honestly can speak on the best way since I haven't implemented my own yet nor do I think one way will always be best for every situation.