Organization of Users and Groups in Corporate Directory 

Entries in an LDAP directory are organized in a tree-like structure called the Directory Information Tree (DIT). The Enterprise Portal supports certain methods of arranging users and groups in a DIT in the corporate LDAP directory, which are:

These options for the DIT are described in more detail below. If you do not use one of these options, you must implement a plug-in to access the group hierarchy. The User Management component provides an application programming interface (API) for customer specific group hierarchies.

When you configure the portal in the user management configuration tool, you must specify how you have chosen to arrange users and groups in the DIT in your corporate directory. For more information, see Defining Location of Central User Data Repository.

Do not use the special characters ‘/’ and ‘\’ in user and group names.

Groups as Tree

The main characteristic of this method of organizing users and groups is that users are entries below the group of which they are a member.

The disadvantage of this schema is that users can only appear at one point in the directory tree and can therefore only be members of one group and its supergroups (the groups above it in the tree).

The following diagram illustrates a schema where a group is a tree.

If you use this method of arranging users and groups in your corporate directory, you must set the flag labelled Users are stored under groups in the hierarchy when configuring the portal. See Defining Location of Central User Data Repository.

 

Flat Hierarchy

In a flat hierarchy, the DIT has separate branches for user and group data. There are two possibilities:

Whichever option you choose, this structure has the advantage that a user can be a member of more than one group. The disadvantage is that when you add a user to the hierarchy, the user is not assigned to any groups. The administrator must assign groups explicitly.

The following diagram illustrates a simple example of a flat hierarchy where each group has an attribute listing the members of that group. More complex trees containing more than one people or group branch are also possible.

It is also possible to have a hierarchy of groups in the people and/or groups branch. The hierarchies in the people and groups branches do not have to be identical. The following diagram illustrates a hierarchy in the groups branch.

If you use the 'Flat Hierarchy' method of arranging users and groups in your corporate directory, you must set the flag labelled Groups point to their members when configuring the portal. See Defining Location of Central User Data Repository.

See also Improving Performance of User Management Components, for details on how to improve the performance of the Enterprise Portal if you have implemented a flat hierarchy in your corporate LDAP directory.