Providing ldap group names as an attribute revisited

[Farrukh Najmi]

On 06/14/2013 12:59 PM, Cantor, Scott wrote:
> David was assuming you would use the memberOf attribute to assign membership on the user entries, not by enumerating them in the group entries. Doing the former is more efficient for this use case than the latter.
...
> His suggestion was that you change your LDAP entries.
>
>

Thanks Scott. I understand David's suggestion better now given your 
explanation.

If I were to change to use memberOf attribute to assign membership on 
the user entries, then would that attribute be somehow protected so that 
users cannot self-assign themselves to groups (like "admin", "superuser" 
etc.).

The approach I have now keeps group membership under the control of the 
group owner and not individual users. This seems more secure.

Lastly, using a relational db is not a choice for me due to other 
constraints. It has to be LDAP at present. Thanks again.

-- 
Regards,
Farrukh Najmi

Web: http://www.wellfleetsoftware.com