Re: Schema design - multiple structural objectclasses

["Graeme Joyce" <openldap-list@jade.co.nz>]

> This leads me to the conclusion that a single entry per person would be a
> good idea from the management point of view, using all of the above
> objectclasses concatenated together. I plan to use access control to give
> alternative "views" of the same data
>
I agree, if you need only one account per person. See:
http://www.openldap.org/lists/openldap-general/200001/msg00043.html
for an idea if you need multiple accounts per person.

> However, this seems to go against the recommendations in Howes, Smith, &
> Good's excellent (but weighty) book. I don't really understand why
multiple
> structural objectclasses in an entry aren't a good idea. Anyone care to
> comment?
see:
http://www.openldap.org/lists/openldap-software/200001/msg00075.html

I think "posixAccount" is an auxilliary class, while "account" is definitely
structural. If you add posixAccount only (ie not "account") as an additional
objectclass on your person entries, that should allow you to use the
attributes you need, without breaking the "one structural objectclass" rule.
At least that's what I've done and (so far) it seems OK. The real test will
be upgrading to OpenLdap V2 I guess.

> Is my "smash it all together" design going to haunt me in future?
If it does, you wont be alone :-)