Either way you’d need to write some code

OpenLDAP already has meta directory capabilities (man slapd-meta)

Your right. Thanks for pointing that out. (been a while since I checked this one). I updated the link to point to the 10.3 miniboot CD. This should work for 10.2 as well. (although to be honest I have not confirmed this). I also just added a link back to the 10.2 CD.. im not sure why they moved it.

Mark.

So I need the miniboot iso, and it doesn’t seem to be available from the SuSE wiki anymore.

Your link to it, alas, is also broken and may, in addition, be stale (I typed all of this while waiting for the download to start :-).

I would like to comment on one of your points re 80-20. It is important that the roles cover 80% of the PRIVILEGES, not of the USERS. In every organization, there are many users that get “trivial” access rights. If you ONLY cover them then you have done nothing for provisioning automation. Unfortunately, in our experience, the 10-20 roles are enough to cover 80% of people, but by no means 80% of the access rights.

I would also like to strengthen your point that there is no one-size-fits-all recipe for roles. Hence, you should indeed be suspicious of any vendor that comes and tells you that they can create the roles for you and in a hurry. Consider this: even if two organizations had exactly the same access rights, it may still be beneficial to create different roles structure for them. This is because an effective roles structure depends on the organizational structure, processes, practices, and even culture.

Instead, we find it useful to precede role engineering with simulations of 10-20 different combinations of role engineering methodologies. We then see which methods are (a) intuitive to the organization, and (b) result in a good coverage of the privileges. Such simulation, supported by our pattern recognition technology, provides us with very important intelligence that tells us which role engineering approach is likely to be successful for this company.

Enjoy…

Dr. Ron Rymon
Founder
Eurekify - Privileges, Roles, and Policies
http://www.eurekify.com