LDAP

Figure 1055. Recommended readings

Figure 1056. Openldap server documentation

Exercises are based on the OpenLDAP server implementation.

Related material at http://www.openldap.org.

Figure 1057. What is LDAP anyway?

Lightweight Directory Access Protocol
Vendor independent
IETF standard:

Clients interact with servers using a directory access protocol

Figure 1058. LDAP Server cli bind

Command Result

Command	Result
`ldapsearch \ -h localhost ❶ \ -D "cn=admin,dc=betrayer,dc=com" ❷\ -w password -x ❸\ -b "dc=betrayer,dc=com" ❹\ -s sub ❺ \ -LLL ❻`	`dn: dc=betrayer,dc=com ❶ objectClass: top objectClass: dcObject objectClass: organization o: Betrayers heaven ❷ dc: betrayer dn: cn=admin,dc=betrayer,dc=com ❸ objectClass: simpleSecurityObject objectClass: organizationalRole cn: admin ❹ description: LDAP administrator userPassword:: e1NT...dE53N1E= ❺`

ldapsearch \
  -h localhost ❶ \
  -D "cn=admin,dc=betrayer,dc=com" ❷\
  -w password -x ❸\
  -b "dc=betrayer,dc=com" ❹\
  -s sub ❺ \
  -LLL ❻

dn: dc=betrayer,dc=com ❶
objectClass: top
objectClass: dcObject
objectClass: organization
o: Betrayers heaven ❷
dc: betrayer 

dn: cn=admin,dc=betrayer,dc=com ❸
objectClass: simpleSecurityObject
objectClass: organizationalRole
cn: admin ❹
description: LDAP administrator
userPassword:: e1NT...dE53N1E= ❺

❶	An LDAP server's DNS name or IP address (host).
❷	The bind DN. This path is being required to uniquely identify an existent user entry on the server in question. This corresponds to a login name when using e.g. web gui authentication.
❸	The corresponding password to the given bind DN. The user entry must contain a corresponding userPassword hash value. The `-x` indicates using simple password based rather than SASL authentication.
❹	The search will start from this uniquely defined node within the servers DIT. In the current example we simply choose the tree's top level node.
❺	The search scope. See The LDAP Search Operation for details.
❻	Suppress verbose search information.

❶	The DIT's top level node.
❷	Your organization's name
❸	The administrative user of the server. This entry will typically be created at installation time.
❹	The administrative user's “common name”. Note this entry corresponds to ❹ on the “Command” side of this table.
❺	The administrative user password's hash value. Note the double colon `::` indicating a base64 encoded binary value.

Figure 1059. Document Information Tree (DIT)

‹›

Figure 1060. Relative and absolute DNs

‹›

Figure 1061. User example

dn: uid=clark,ou=finance,dc=betrayer,dc=de ❶
cn: Sandy Clark
homeDirectory: /home/clark
sn: Clark
uid: clark ❷
uidNumber: 21101
givenName: Sandy
loginShell: /bin/bash
mail: clark@betrayer.com ❸
mail: finance@betrayer.com
postOfficeBox: 10G
userPassword: {SSHA}noneOfYourBusiness

❶

The entry's absolute distinguished name (DN). This name/value list uniquely identifies an entry (an its position) within a given DIT.

❷

This key/value combination is guaranteed to be unique within respect to the given parent node. It allows to identify each node with respect to its parent. So in a relational model the “clark” entry would become a weak entity having an identifying ownership relation to its parent organisational unit by virtue of its uid value.

In other words: There is only one such entry below ou=finance,dc=betrayer,dc=de having an uid attribute of value clark.

❸

LDAP allows for multi valued attributes.

Figure 1062. objectClass

Structuring LDAP entry data.
Categories:
- Structural
- Auxiliary
- Abstract

Figure 1063. objectClass clarifications

Abstract classes:

To be extended by other classes

Structural classes:

Each entry requires exactly one.
Specify the “main” type of object.
Must not inherit from auxiliary classes.

Auxiliary classes:

Provide non-conflicting supplementary information.
Think of (Java™) interfaces.
Must not inherit from structural classes.

Figure 1064. Augmenting inetOrgPerson by posixAccount

Class                       |   Instance uid=clark,ou=finance,dc=betrayer,dc=de
----------------------------+---------------------------------------------------
inetOrgPerson (structural)  |                   
   sn                       |    sn: Clark
   cn                       |    cn: Sandy Clark
  ...                       |     ▲
                            |     ┃
posixAccount (auxiliary)    |     ┃
  cn                        |   see above ❶
  gidNumber                 |   gidNumber: 23113
  homeDirectory             |   homeDirectory: /home/clark
  uid                       |   uid: clark
  uidNumber                 |   uidNumber: 21101
  userPassword              |   userPassword: {SSHA}noneOfYourBusiness
                          .....

❶	The cn attribute is being defined both in object class `inetOrgPerson` and `posixAccount`. This requires data type definitions to be compatible.

Figure 1065. Structural objectClass definitions

‹›

Figure 1066. Search scopes

RFC 4520 defines three LDAP search scopes:

baseObject (base)
singleLevel (one)
wholeSubtree (sub)

Figure 1067. Predicate based queries

RFC 4520 defines predicate based queries using RPN style:

(| (cn=k*) (uidNumber < 2000))

Figure 1068. LDAP bind types

Anonymous bind: No user credentials.

Note: This typically provides limited privileges.

Simple bind: User's DN + password:

DN: uid=clark,ou=finance,dc=betrayer,dc=de
password: 123456789

Figure 1069. LDIF exchange format

Ldap Data Interchange Format.
Importing and exporting LDAP Data.
Modifying existing entries (CRUD operations).
Pure ASCII.

Figure 1070. LDIF sample

dn: uid=clark,ou=finance,dc=betrayer,dc=de
objectClass: posixAccount
objectClass: inetOrgPerson
cn: Sandy Clark
homeDirectory: /home/clark
sn: Clark
uid: clark 
uidNumber: 21101
givenName: Sandy
loginShell: /bin/bash
mail: clark@betrayer.com 
mail: finance@betrayer.com
postOfficeBox: 10G
userPassword: {SSHA}noneOfYourBusiness

Figure 1071. OpenLdap server architecture

‹›

An OpenLdap server may host multiple DITs each being represented by its own database backend.
The server's configuration is itself being stored as a separate tree.
Each tree refers to a separate database backend. Thus the above example featuring two trees is being implemented by two database instances.

Prev	Up	Next
Mail exchange record	Home	Recommended Preparations

Software defined Infrastructure