Campus Directory Organizational Units (OU) and LDAP Structure

Data in the Campus Directory is divided into "Organizational Units" (OUs) based on function and/or purpose. An OU is also referred to as a "bucket," "branch," or "node."

Top-Level Directory Root

The OUs directly beneath the top-level Directory root or suffix entry "dc=berkeley,dc=edu" are:

Image-based organizational structure

People OU	ADVCON People OU (alumni)	PreSIR OU	Guests OU	Expired People OU
			Sponsored Guests Student-Delegates

Additional images of organizational tree

Applications OU	Org Units OU	Authorizations OU	Campus Groups OU

People (ou=people,dc=berkeley,dc=edu)

The 'people' branch contains all LDAP entries representing students, staff, and affiliates of the University of California, Berkeley. Please see the links below for details on how data is represented in LDAP for these groups:

• People OU - Students
• People OU - Staff
• People OU - Affiliates
• Primary LDAP Person Entry Details

PreSIR People (ou=presir people,dc=berkeley,dc=edu)

When do students move from the PreSIR OU to the People OU?

Students admitted for Fall move from OU=PreSIR People to OU=People two days after they submit the Statement of Intent to Register (SIR) and pay the fees online. If the student chooses to pay by check, the record will move to OU=People once the Admissions office has cleared the check. Spring students who enroll in the Fall Program for Freshman will also be moved to the PeopleOU once they are enrolled, subject to having paid fees as indicated above.

Advcon People (ou=advcon people,dc=berkeley,dc=edu)

The ADVCON OU contains records for people who have only alumni affiliations. Alumni affiliations are provided by University Development and Alumni Relations.

The data in the 'ou=advcon people' container is restricted. Developers wanting access to alumni information must request a Privileged LDAP Bind, and the request must be approved by University Development and Alumni Relations.

Guest OU (ou=guests,dc=berkeley,dc=edu)

This OU is used to store users who are identified as short and long-term guests. The CalNet Guest account information is added to the LDAP under ou=guests and is assigned the affiliate type: GUEST-TYPE-SPONSORED.

Available Guest Attributes

dn: uid=NNNNNNN,ou=guests,dc=berkeley,dc=edu
objectClass: berkeleyEduPerson
uid: NNNNNNN
berkeleyEduAffiliations: GUEST-TYPE-SPONSORED
displayName: MyUCB Guest
ou: guests

For information on eligibility, see: CalNet Sponsored Guests

Expired People (ou=expired people,dc=berkeley,dc=edu)

This branch contains an archive of LDAP entries representing individual users whose affiliation(s) have completely expired. Once an expired user has exceeded their allowed "grace period," the entry is moved from 'ou=people' to 'ou=expired people' for archival purposes.

Applications (ou=applications,dc=berkeley,dc=edu)

The "applications" branch contains the privileged binds of services that have applied for special access to restricted Directory data.

CalNet-enabled applications that have registered for access to privileged CalNet data are assigned "application binds." These binds are used by the applications to securely connect to the CalNet Directory to perform queries and access data. Developers may request a privileged bind by following the Applying for Directory Access process.

Organizational Units (ou=org units,dc=berkeley,dc=edu)

The CalNet Directory includes a complete hierarchical representation of the entire UC Berkeley campus organizational unit structure. This information is accessed by privileged application binds (accounts) for use in campus applications. The "Org Unit" data structure is refreshed nightly from data provided by the Enterprise Data Warehouse (EDW).

The entire Org Unit structure resides in the node ou=org units,dc=berkeley,dc=edu. This node serves as a container to encapsulate the entire structure within a logically named branch. Applications must use this node as the search-base for all queries.

Each organizational unit entry is based upon the berkeleyEduOrgUnit objectclass, which includes attributes such as berkeleyEduOrgUnitProcessUnitFlag, berkeleyEduOrgUnitHierarchyString (e.g., UCBKL-AVCIS-VRIST-JICCS), and berkeleyEduOrgUnitParent.

Example Search Filters and Settings

To search for...	search-base	scope	filter
All Process Units	ou=org units,dc=berkeley,dc=edu	subtree	(berkeleyEduOrgUnitProcessUnitFlag=*)
Units under 'VPUEI'	ou=org units,dc=berkeley,dc=edu	subtree	(berkeleyEduOrgUnitParent=VPUEI)
Units directly beneath 'VRIST'	ou=VRIST,ou=AVCIS,ou=UCBKL,ou=org units,dc=berkeley,dc=edu	one	(ou=*)