LDAP Architecture for CardDAV/OpenLDAP interface

[Nicolas Mora <nicolas@babelouest.org>]

Hello,

I'm using both an OpenLDAP server and an owncloud server, both for 
different but convergent purposes.

The OpenLDAP manages an addressbook that is used by all mail client 
(Thunderbird, Horde, etc.), and the owncloud server also manages an 
addressbook for phone numbers, addresses and stuff, this one is a 
CardDAV one with VCard files.

My goal is to converge these 2 different back-ends into one, all the 
data would be stored in the LDAP server.

I did some research about how to do it and I have some clue that I would 
like to submit to you for feedbacks.

The first interrogation is about the VCard/LDAP interface.
After studying the VCard format and the different LDAP schemas, mostly 
RFC 6350 and 2256 and the schema files in the OpenLDAP conf folder in a 
Debian Stable server.
I think that a new schema would do the connection.

All the VCard properties can be easily linked to an existing person or 
inetOrgPerson or another *person objectClass. And the properties that 
doesn't exist yet are to be created in a schema extension.
Also, one or two additional properties fields per property are to be 
created for the VCard parameters.

Actually, there are different objectClass that might be extended: 
person, inetOrgPerson, organizationalPerson and residentialPerson. 
Considering that inetOrgPerson, organizationalPerson and 
residentialPerson are designed for specific purposes, I think that 
extending the person objectClass would be the best guess, what do you 
think ?

The second question is more about the OpenLDAP configuration to handle 
this need. Right now, the OpenLDAP server is only used by me as an 
addressbook and an authentication server, the directory looks like this:

dc=babelouest,dc=org
|
|-ou=addressbook
|  |
|  |-cn=Address1
|  |-cn=Address2
|  |-[...]
|
|-ou=users
|  |
|  |-uid=user1
|  |-uid=user2
|  |[...]

I would like to add another branch to allow users to add their own 
addressbook entries, these entries would be in read/write mode only for 
the owner, no one else but him should have access.

The new directory would look like this:
dc=babelouest,dc=org
|
|-ou=addressbook (global, read-only for all users)
|  |
|  |-cn=Address1
|  |-cn=Address2
|  |-[...]
|
|-ou=users
|  |
|  |-uid=user1
|  |-uid=user2
|  |[...]
|
|-ou=personnalAddressbooks (personnal addressbook entries)
|  |
|  |-uid=user1
|  |  |
|  |  |-cn=Address1
|  |  |-cn=Address2
|  |  |-cn=Address3
|  |
|  |-uid=user2
|  |  |
|  |  |-cn=Address1
|  |  |-cn=Address2

I took a look at the Access control help page but I couldn't find how to 
properly set the OpenLDAP configuration like this. Can you help me 
configuring the slapd.conf ?

Thanks in advance.

/Nicolas