Organizing Users in Organizational Units

[privacyidea]

Is it possible to create organizational units (LDAP structure OU) to put users into different OUs?
Currently all users are located flat in the container CN=users, which can be a bit confusing.

I see that user objects can be moved. But is it also possible to create new OUs to move users into these OUs?

Thanks a lot
Cornelius

[Grandjean]

Hello Cornelius,

yes, sure You can either use the “LDAP directory” module in the blue “Domain” category in the UMC and just “Add” an object of the type “Organizational Unit”:

Or you can use udm for this, too:

udm container/ou create --set name=Berlin \
    --set description="OU for users based in Berlin" \
    --set userPath=1

Make sure to set userPath=1. Otherwise the newly created OU will not show up in the dropdown as possible location when creating a new user via UMC.

Now you can simply specify a position when creating new users. E.g. for udm:

udm users/user create \
    --position "ou=Berlin,$(ucr get ldap/base)" \
    --set username="mary" \
    --set firstname="Mary" \
    --set lastname="Somerville" \
    --set password="SecretPassw0rd"

Or via UMC:

[bbassotti]

Yes, you just need to create the organizational unit and then you can move / create users.

regards, francesco.

[privacyidea]

@bbassotti @Grandjean thanks a lot!
I probably was confused with where to “ADD” the OU in the LDAP tree. Now everything will work out fine!