Robo Orders Pizza

Scene 4 路 One list of who works here

The staff roster

Scene 1 was the party site's sign-in for visitors. This one is for the people who work at Maple Hill, and the six school systems they use every day.

Go a level deeper ↓

1 A new teacher starts

Mr. Okafor joins on Monday. He needs the five everyday systems.

Without a roster, every system keeps its own list. Add him to each one.

2 Groups, not people

Systems don't list people. They list groups, then ask the roster who's in them. Mr. Okafor also volunteers for the party committee.

The pizza account asks the roster: is okafor in "Party committee"? no

That question travels in LDAP, the language directories speak.

3 Someone leaves

Ms. Chen moves to another school in June. Her access has to go, everywhere.

4 Sign in once for the day

Ms. Rivera signs in at her classroom computer in the morning. The roster checks her password once and hands her a ticket good until evening.

5 The roster can't go down

If the roster is unreachable, nobody can sign in to anything. The roster lives in the main building.

Main buildingroster copy 1
Gym buildingno copy

The copies are domain controllers; a managed directory keeps them in separate Availability Zones.

What you just used

Staff rosterdirectory, most often Microsoft Active Directory
Groupssecurity groups
"Is he in the group?"an LDAP query
Forgotten accountsorphaned accounts
Day ticketKerberos ticket, single sign-on
Second copya second domain controller
Visitors vs. staffcustomer identity (Scene 1) vs. workforce identity

Who builds staff rosters

  • Run your own: Microsoft Active Directory on your own servers, or open-source OpenLDAP and FreeIPA.
  • Active Directory, managed in a cloud: AWS Directory Service, Microsoft Entra Domain Services, Google Cloud Managed Microsoft AD.
  • Directories born in the cloud: Microsoft Entra ID, Okta Universal Directory, JumpCloud.
  • Already have a roster? Connect to it instead of copying it: AWS's AD Connector forwards questions to a directory you already run.
Connects to
  • Who's at the door?: that desk signs in visitors; this roster is for staff. Different jobs, different tools.
  • Is that badge real?: the roster says who works here; the badge office can badge their laptops.
Peek at a real directory

Real LDAP, the same questions a school system would ask, sent to Forum Systems' public read-only test directory (its sample people are famous mathematicians and scientists). Anonymous searches only; nothing is changed.

# 1. Who is this? Look up one person
$ ldapsearch -x -LLL -H ldap://ldap.forumsys.com -b "dc=example,dc=com" "(uid=euler)" cn objectClass
   dn: uid=euler,dc=example,dc=com
   objectClass: inetOrgPerson
   objectClass: organizationalPerson
   objectClass: person
   objectClass: top
   cn: Leonhard Euler

# 2. Who is in this group?
$ ldapsearch -x -LLL -H ldap://ldap.forumsys.com -b "dc=example,dc=com" "(ou=mathematicians)" uniqueMember
   dn: ou=mathematicians,dc=example,dc=com
   uniqueMember: uid=euclid,dc=example,dc=com
   uniqueMember: uid=riemann,dc=example,dc=com
   uniqueMember: uid=euler,dc=example,dc=com
   uniqueMember: uid=gauss,dc=example,dc=com
   uniqueMember: uid=test,dc=example,dc=com

# 3. The question a system asks: is this person in the group?
$ ldapsearch -x -LLL -H ldap://ldap.forumsys.com -b "dc=example,dc=com" "(&(ou=mathematicians)(uniqueMember=uid=euler,dc=example,dc=com))" dn
   dn: ou=mathematicians,dc=example,dc=com
$ ldapsearch -x -LLL -H ldap://ldap.forumsys.com -b "dc=example,dc=com" "(&(ou=mathematicians)(uniqueMember=uid=newton,dc=example,dc=com))" dn
   (no match)
   -> euler: yes, newton: no. One list answers every system the same way.

Run it yourself: lab/staff_roster.py. A managed Active Directory answers the same questions, inside your private network.

Go a level deeper

Plug in, don't rebuild

Maple Hill isn't starting from scratch. It belongs to a district that already runs a staff roster downtown, and every staff laptop and tablet needs to be trusted too.

+1 The district's roster

The district's roster downtown is the official one. How should the school's systems use it?

Connecting is what a directory gateway such as AD Connector does: it forwards sign-in and lookup requests to the existing directory without keeping a copy in the cloud.

+2 A badge for every device

The Wi-Fi and the shared files now want proof of the device, not just the person: a badge from the school's private badge office.

Teacher tablets are managed by the district's device manager instead. Which badge desk should they use?

Laptops in the roster enroll through a connector such as Connector for AD. Tablets use device-management enrollment (SCEP), an older protocol whose known weaknesses are why a dedicated CA is recommended.

Staff roster: 0/6