Why Two Directory Information Trees?

This dual-tree mechanism provides the following enhancements:

• The partitioning of data for organization-specific access control. That is, each organization can have a separate subtree in the DIT where user and group entries are located. Access to that data can be limited to users in that part of the subtree.

• The ability to have a distinct namespace for sub domains. For example, west.siroe.com and siroe.com may be mapped to separate organization subtrees allowing the creation of user entries with the same UID in each one of them.