I am working (conceptually at the moment) on a unified LDAP structure for my enterprise.

Currently, we have islands of LDAP all over the place in various flavors of OD, AD and Sun System Directory. I have counted no fewer than 6 separate OD domains.

Like many of you, I’ve been working the OD/AD magic triangle for years. Now I want to go a bit further and create one instance of a primary LDAP (flavor to be determined), and then one instance each of OD, AD and SunSD, all of which get their authentication information from the accounts stored on the primary directory.

I’m curious if anyone reading this is already doing this or something similar. If so, would you be willing to share your experiences and any caveats or tips you may have discovered along the way?

Would OD make a good primary directory or should it be a secondary directory that gets its authentication from the primary directory and to which Mac clients are bound?

The organization’s email system is Exchange, so I’m thinking it might be simplest to make AD the primary LDAP, since everyone in the company who has an email address already has an AD account.