OVD Roles

Question

Hello folks,
I have some questions regarding OVD roles:
It is possible to defer defined groupings of users to an attached data source?
It is possible to defer defined groupings of users through a PAAM module?
Product administrative roles can have a clear delineation from general client access control?
I know are generic questions but any help can be appreciated.
Thanks

Answer 1

user8846155 wrote:
This method seems a little inefficient compared to the first. I think you can deal with that. Pre-fetch and caching come to mind.
When you say the database is the slave, are you suggesting we keep our user tables for query join purpose? Use some method of synchronization?Yes, exactly. Not just for join purpose but also to avoid changing the app. Avoiding data sunch from LDAP tp your database is a goal that may be less important than having your app work fast and avoid change..this depends on your priorities of course.
If we were to use OVD instead of SQL, we would need some method of representing our role/context associations in OVD.
User-> Role-> One or more context values for user association to role.
As a user, I may be an agent for two customers, with 1 having further restriction on contracts.
Role      Context
Agent Customer X
Agent Customer Y, Contract Z
I apologize if I am not being very clear.Your question is basically how to translate database schema to directory schema. There's many ways to do that. One way:
Object class Role
- attribute customerID
- attribute contractID
Object class User
- multi-valued attribute 'role' of type Role
User entry for Agent / Customer X
- objectclass User with 'role' set to Agent.
- objectlcass Role with 'customerID' set to CustomerX
User entry for Agent / Customer Y
- objectlcass User with 'role' set to Agent.
- objectclass Role with 'customerID' set to CustomerY and 'contractID' set to Contract Z.
Then it's very easy to construct an LDAP query to pull out your users depending on their role and context (customer and contract).