External users and groups in LDAP

[ryancragun]

As a Chef Server user I would like to manage org/user/group RBAC's via a Directory Service integration. This would allow me to set default organizations for users and have a single source of truth for user access.

[jhsubscribe]

This would be really useful for us too.

Extending the "Directory server as single source of truth" concept, I wonder if it's worth also considering the Chef server pulling the users Public Keys from LDAP/AD? e.g. for OpenLDAP I've seen references to using the sshPublicKey attribute for integration with SSH and on AD there's the userCertificate attribute which contains x509 certs? I think that this, combined with ryancragun's suggestion, would mean there'd be no per-user configuration required on the chef-server?