Background: I've successfully set up OpenLDAP on Ubuntu 12.04 (UB1) to centralise and remotely administer authentication of users on a single Linux machine using PAM. I can give each user arbitrary group membership.
Next, I plan to use LDAP referrals (aka delegation) to authenticate users on this LDAP against Active Directory (AD1).
I have two other machines (UB2 and UB3) that need to do local LDAP logins, and also maintain a cache of the database on UB1. In the future there will be many more Linux (not necesserily Ubuntu) machines - many hundreds.
i.e. Ultimately, bar local users at each machine, all Linux users permissions are managed on LDAP (UB1) except for authentication of a subset of certain users which is done via UB1 but from AD1.
The question: I've searched the net, there are many examples of getting as far as I have, but I can't find anything on how to administer a domain consisting of many systems.
How do I configure LDAP on UB1 to apply different permissions and groups to each authenticated user or machine, depending on which machine UB2,UB3,.....UB999 they are logging in on.
E.g. User1 may be able to perform action X on UB2, but not on UB3. User1 may belong to Group1 on UB2, but not UB10. Group1 may exist on UB4, but not UB5.