databaseauthenticationactive-directoryldapsap-hr

where to store personnel information LDAP or Database


In our application we are evaluating where to store all personnel information (name, email, phone, department, date of birth, date of hire, licenses/certificates, roles etc.).

We will use LDAP/Active Directory for user authentication/authorization so at least some of these data will go into LDAP server.

Our HR module and other applications also need some of these information and there is an overlap between them. We are thinking on storing all information in LDAP and just use user ID as a reference in our RDMS to LDAP user and populate other details of user during login process.

Other than our application there will be other applications which will also use same user information. If we do not store personnel detail in LDAP we will need to duplicate and synchronize user information in each system. LDAP will be needed for login information anyway.

What is your recommendation on storing personnel detail in LDAP or DB tables?


Solution

  • Generally speaking, Active Directory isn't a good place to put sensitive PII like what you list. There's absolutely no technical reason that it can't store this data, but, securing it is more difficult. It's certainly not insurmountable, but, I would definetely suggest keeping HR data with HR and synchronizing any demographic information necessary to AD.

    Use the Employee ID value in your HR system to maintain the relationship back to AD.