LDAP Implementation Cookbook

3.6. Evaluate the Existing Security Policy

If, based on the evaluation done in section 3.3 on page 68, you determine that you will use (reuse) existing objects and attributes in the LDAP directory, you must re-evaluate your security policy against the existing security policy for those shared objects and attributes that are to be stored in the directory.

Having designed the directory tree, you now need to decide on a security policy. A security policy should be strong enough to prevent sensitive information from being modified or retrieved by unauthorized users while simple enough to keep administration simple and enable authorized parties to access it easily. Ease of administration is very important when it comes to designing a security policy. ...