Campus Directory Organizational Units (OU) and LDAP Structure
Data in the Campus Directory is divided into "Organizational Units" (OUs) based on function and/or purpose. An OU is also referred to as a "bucket," "branch," or "node."
Top-Level Directory Root
The OUs directly beneath the top-level Directory root or suffix entry "dc=berkeley,dc=edu" are:
| People OU | ADVCON People OU (alumni) | PreSIR OU | Guests OU | Expired People OU |
|---|---|---|---|---|
Sponsored Guests |
| Applications OU | Org Units OU | Authorizations OU | Campus Groups OU |
|---|---|---|---|
People (ou=people,dc=berkeley,dc=edu)
The 'people' branch contains all LDAP entries representing students, staff, and affiliates of the University of California, Berkeley. Please see the links below for details on how data is represented in LDAP for these groups:
Primary LDAP Person Entry
For each campus user, there will be one primary LDAP "person" entry representing the user.
PreSIR People (ou=presir people,dc=berkeley,dc=edu)
When do students move from the PreSIR OU to the People OU?
Students admitted for Fall move from OU=PreSIR People to OU=People two days after they submit the Statement of Intent to Register (SIR) and pay the fees online. If the student chooses to pay by check, the record will move to OU=People once the Admissions office has cleared the check. Spring students who enroll in the Fall Program for Freshman will also be moved to the PeopleOU once they are enrolled, subject to having paid fees as indicated above.
Advcon People (ou=advcon people,dc=berkeley,dc=edu)
The ADVCON OU contains records for people who have only alumni affiliations. Alumni affiliations are provided by University Development and Alumni Relations.
The data in the 'ou=advcon people' container is considered private. Developers wanting access to alumni information request a Privileged LDAP Bind, and the request must be approved by University Development and Alumni Relations.
Note that if an alum has any other affiliations with the campus (employee, student, etc), their record will be located in OU = People. OU = ADVCON contains users whose affiliations consist of the 'Advancement Constituent People' types only.
Guest OU
Sponsored Guest data is stored in the campus directory (LDAP) and is therefore the authoritative source of all Sponsored Guest data.
Guests (ou=guests,dc=berkeley,dc=edu)
This OU is used to store users who are identified as short and long-term guests, i.e. all user profiles that do not qualify as student, staff, faculty or other known affiliate types are stored under this OU.
Account Creation - When do records enter LDAP?
The CalNet Guest account information is added to the LDAP after a short delay, under ou=guests, and is assigned a new affiliate type: GUEST-TYPE-SPONSORED.
Public and Private Attributes
The following are available Guest Attributes in LDAP:
dn: uid=NNNNNNN,ou=guests,dc=berkeley,dc=edu objectClass: berkeleyEduPerson objectClass: eduPerson objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: person objectClass: top objectClass: ucEduPerson cn: Guest, MyUCB sn: Guest uid: NNNNNNN berkeleyEduKerberosPrincipalString: uidNNNNNNN mail: <guest email address> berkeleyEduAffiliations: GUEST-TYPE-SPONSORED berkeleyEduConfidentialFlag: false berkeleyEduGuestSponsorUid: nnnnnnn displayName: MyUCB Guest givenName: MyUCB ou: guests
For information on eligibility and creation, see: CalNet Sponsored Guests
Expired People (ou=expired people,dc=berkeley,dc=edu)
The 'expired people' branch (ou=expired people,dc=berkeley,dc=edu) of the CalNet Directory contains an archive of LDAP "people" entries representing individual users whose affiliation(s) with the University of California, Berkeley have completely expired.
Once an expired user has exceeded their allowed "grace period," the user's "people" entry is removed from the 'ou=people' container and placed into the 'ou=expired people' container for archival purposes. User entries contained within the 'ou=expired people' are no longer eligible for centrally offered services.
Applications (ou=applications,dc=berkeley,dc=edu)
The "applications" branch of the CalNet Directory contains the CalNet Application entries (privileged binds) of each service and/or applications that have applied for special access to restricted Directory data.
CalNet-enabled applications that have registered for access to privileged CalNet data are assigned "application binds." These binds are then used by the applications to securely connect to the CalNet Directory for access to private data. Developers may request a privileged bind by answering the questions listed on the Applying for Directory Access page. The CalNet team forwards responses to the data proprietor (HR for staff, Registrar for students - please see Authoritative Sources of Data in LDAP) for review.
Organizational Units (ou=org units,dc=berkeley,dc=edu)
The CalNet Directory includes a complete hierarchical representation of the entire UC Berkeley campus organizational unit structure. This information can be accessed by privileged application binds (accounts) for use in their applications. The Organizational Unit, or "Org Unit" data structure is refreshed nightly from data provided by the Enterprise Data Warehouse (EDW).
The entire Org Unit structure resides in the node ou=org units,dc=berkeley,dc=edu of the CalNet Directory. This node is not recognized as part of the campus structure, but merely a container to encapsulate the entire structure within a logically named node/OU. Applications should use this node as the search-base for all queries. If the entire Org Unit structure needs to be examined from the beginning, recursive searches with scopes of "one" will need to be used in order to not exceed the Directory Search Results Limit.
Within this top-level 'org units' branch resides the ou=UCBKL Campus Root node. This node is the base, or root, of the entire UC Berkeley Organizational Tree. Because the Org Unit structure is a hierarchy, applications can selectively browse discrete portions of the tree or can recursively traverse the entire structure.
Each organizational unit entry is based upon the berkeleyEduOrgUnit objectclass:
- berkeleyEduOrgUnitProcessUnitFlag
- berkeleyEduOrgUnitHierarchyString
- berkeleyEduOrgUnitParent
Programmatic Exploration (Perl Script)
As previously noted, the CalNet Directory will not return search results to any query that results in more than 500 entries. Included below is a sample PERL script that demonstrates how to recursively browse the entire Org Unit structure without exceeding the directory search-result limit.
#!/bin/perl
use Mozilla::LDAP::Conn;
$LDAPSRVR = 'caldir.berkeley.edu';
$LDAPPORT = '389';
$LDAP_SEARCH_BASE = 'ou=UCBKL,ou=Org Units,dc=berkeley,dc=edu';
$conn = new Mozilla::LDAP::Conn($LDAPSRVR,$LDAPPORT,'','');
die "Couldn't connect to LDAP server $LDAPSRVR" unless ($conn);
&traverse_org_unit($LDAP_SEARCH_BASE);
exit(0);
sub traverse_org_unit()
{
my ($start_dn) = @_;
my ($entry, $dn, $ldap_scope, $filter, $dn) = "";
my (@dns, @attributes) = ();
@attributes = ( "ou" );
$ldap_scope = "one";
$filter = "(ou=*)";
$entry = $conn->search($start_dn, $ldap_scope, $filter, 0, @attributes);
if (! $entry) { }
else {
while ($entry) {
$dn = $entry->getDN();
push (@dns,$dn);
print "Org-Unit: $dn\n";
$entry = $conn->nextEntry();
}
}
foreach $dn (@dns) { &traverse_org_unit($dn) }
}
Example Search Filters and Settings
| To search for... | search-base | scope | filter |
|---|---|---|---|
| all Process Units: | ou=org units,dc=berkeley,dc=edu | subtree | (berkeleyEduOrgUnitProcessUnitFlag=*) |
| all Units under Control Unit 'VPUEI': | ou=org units,dc=berkeley,dc=edu | subtree | (berkeleyEduOrgUnitParent=VPUEI) |
| all Process Units under Control Unit 'VRIST': | ou=org units,dc=berkeley,dc=edu | subtree | (&(berkeleyEduOrgUnitParent=VRIST)(berkeleyEduOrgUnitProcessUnitFlag=*)) |
| all Control Units under Control Unit 'VRIST': | ou=org units,dc=berkeley,dc=edu | subtree | (&(berkeleyEduOrgUnitParent=VRIST)(!(berkeleyEduOrgUnitProcessUnitFlag=*))) |
| all Units directly beneath Control Unit 'VRIST': | ou=VRIST,ou=AVCIS,ou=UCBKL,ou=org units,dc=berkeley,dc=edu | one | (objectclass=*) |