title: How to design LDAP groups for access to applications?
body: <p>I'm pretty new to LDAP and I have a question how I should design the LDAP groups (subgroups?) for centralised user management, for example with JIRA, Jenkins and other applications. </p>
  
  <p>I have an open ldap setup on debian running with jira and jenkins authorising based on groups like for example this developers group:</p>
  
  <pre><code>cn=developers,ou=groups,dc=example,dc=com
  dn: cn=developers,ou=groups,dc=example,dc=com
  cn: developers
  member: cn=John Doe,ou=people,dc=example,dc=com
  objectclass: groupOfNames
  </code></pre>
  
  <p>My question is on best practice for the LDAP setup in this kind of situation. Ideas and questions:</p>
  
  <ul>
  <li>Should I just continue to use the developer group and manage all
  authorization within individual applications like jira based on this
  group. So delete jira-developers in jira and work with developers
  group.</li>
  <li>Should I create individual groups for each application, e.g. (jira-developers-group) and just maintain each application individually in LDAP?</li>
  <li>Should I try to setup a subgroup (subordinate?) structure, so every member of developers is automatically a member of jira-developers, jenkins-developers etc? </li>
  </ul>
  
  <p>I have the I've read <a href="http://www.zytrax.com/books/ldap/" rel="nofollow">http://www.zytrax.com/books/ldap/</a> for a large part and thought it was helpful, but I'm still not sure what's the best / most common way to do it. The organisation is not very big, though I'd like to be future proof. Any help would be great. </p>