title: Role-based security implementation in LDAP
body: <p>I'm working on role-based security implementation in LDAP and Java. Specifically, I have the following objects that I need to represent in LDAP:</p>
  
  <ul>
  <li>Users</li>
  <li>Corporate groups of users - HR, Finance etc.</li>
  <li>Permissions - DOCUMENT_READ, DOCUMENT_MODIFY etc.</li>
  <li>Roles - ADMIN, GUEST etc.</li>
  </ul>
  
  <p>Roles are basically groups of permissions, and they can be assigned to a user or to a group of users. </p>
  
  <p>I was thinking of representing them in LDAP as folows:</p>
  
  <ul>
  <li>Users - Person and uidObject classes with userPassword attribute.</li>
  <li>Groups of users - organizationalUnit class, under which the users are
  located.</li>
  <li>Roles - groupOfNames object class.</li>
  <li>Permissions - not sure about this one, perhaps also groupOfNames
  class.</li>
  </ul>
  
  <p>The idea is to have a quick access from a user or a group to a list of roles that this user or group have. I know that I can put users and groups in a "member" attributes of a role, but then I will have to scan all roles to find which ones have this user listed. Is there a way to have something like the "member" attribute in a Person object? </p>
  
  <p>Generally, does anyone know of a good role-based security implementation in LDAP? I could not find good documentation or tutorials on this subject. I'm using ApacheDS as an LDAP server currently, but I'm open to suggestions.</p>