Grouping LDAP users with custom attribute

I have a web application and I want to control which user can see what data. So I thought a user can belong to a group (ie. DBA, Middleware specialist, UNIX guys, etc.) and the logged in user can only see its data in the app.
I want LDAP to do the authentication. I assume there aren't such groups specified in LDAP (ie. I don't want to use LDAP groups as I cannot force the company LDAP to create groups and put the users in those groups).

What I think of is a flexible solution like being able to use a custom attribute on each user (let's say named 'acces_groups') what the groups can be enlisted comma separated string.
I read that the schema of an objectClass (like organizationalPerson) has to be altered to do that. But is there an easy way to add such a custom attribute to a user in LDAP (I am talking about an already working company LDAP)? Or how would you solve this (without disrupting/breaking the current LDAP)? I didn't say what kind of LDAP (OpenLDAP, active Directory, etc.) for a reason as I'd want a common solution here.

These are two possible solutions/implementations :

• What you supposed : You can add a schema and not alter the organizationalPerson objectClass. (Because altering an already established schema will make your LDAP not standart) Then you add this objectClas to all your users to allow them to use the attributes defined by this schema.

  You can define the acces_groups attribute and make it multi-value. You could also define one attribute per flag you need dba, middleware, etc. and make it a boolean, etc.

  Why I would not do any this :

  • This is a much more complicated and intrusive way to do it than using built in mechanisms that are readily available in LDAP.
  • If your LDAP administrator allows youto modify your LDAP schemas like that, it should be no problem to ask him to use groups instead as this method is much less complicated and time consuming to implement
  • To manage it on daily basis is just a pain because you have no integrity mechanism. All the "CRUD" operations on the "emulated" group will have to be done "manually"
    • If you want to delete a group, you will have to delete the attribute on all the users who have it set.
    • If you want to list the "group", you will have to search all the users who have the attribute set with the correct value
    • etc.

• Using groups : You can indeed create groups such as dba, middleware, etc. and assign the users to those groups.

  • It will allow you the use of group member ship and automatically populate an attribute in your user with the group which he is part of
  • It is LDAP standart and only need dealing with data than dealing with LDAP configurations (which involves downtime, possible errors/setbacks, etc.)
  • If your company allows you to modify the LDAP configuration AND the data of the users, then it should also allows you to create groups and assigning people to it