OpenLDAP - Open Source Implementation of the LDAP Protocol
LDAP is the Lightweight Directory Access Protocol. LDAP’s basic unit is the entry, which is made up of attributes; attributes are constrained by ObjectClasses, and ObjectClasses and their associated attributes are defined in a schema.
Introduction
Entry
An entry, also called a record, is the most basic unit in LDAP, similar to a row in a database. Adding, deleting, modifying, and searching in LDAP are generally all done with the entry as the basic object. [1]
Every entry begins with a unique distinguished Name (DN), such as DN: cn=baby,ou=marketing,ou=people,dc=lfzyx,dc=org”. Thanks to the hierarchical syntax of the DN, an entry’s position in the LDAP tree can be conveniently represented, which is commonly used for searching. The RDN refers to the leftmost segment of the DN before the first comma, e.g. cn=baby. The very top of the LDAP directory tree is the root, known as the “Base DN”, such as “dc=mydomain,dc=org”.
Attribute
Every entry can have many attributes; for instance, a typical person has attributes like name, address, and phone number. Every attribute has a name and a corresponding value.
LDAP has designed attributes for objects commonly found in personnel organizational structures:
Attribute |
Alias |
Syntax |
Description |
Value (example) |
|---|---|---|---|---|
commonName |
cn |
Directory String |
Name |
lfzyx |
surname |
sn |
Directory String |
Surname |
zhou |
organizationalUnitName |
ou |
Directory String |
Organizational unit (department) name |
DevOps |
telephoneNumber |
Telephone Number |
Phone number |
911 |
|
objectClass |
Built-in attribute |
inetOrgPerson |
ObjectClass
Attributes cannot be defined arbitrarily — they need to follow certain rules, and those rules are set through a schema. For example, if an entry isn’t defined with the objectClass: inetOrgPerson from the inetorgperson schema, you cannot set the employeeNumber attribute on it, because employeeNumber is defined in inetOrgPerson.
ObjectClass is a collection of attributes. LDAP anticipates many objects commonly found in personnel organizational structures and packages them into object classes. For example, person has attributes like surname (sn), given name (cn), telephone (telephoneNumber), and password (userPassword); organizationalPerson is a subclass of person that, besides those attributes, also has title, postalCode, postalAddress, and so on. Object classes make it convenient to define entry types. Each entry can directly inherit from multiple object classes, thereby inheriting various attributes.
Schema
ObjectClass, AttributeType, and Syntax define entries, attributes, and values respectively. Together these make up the Schema — a collection of object classes. Entry data usually needs to pass schema validation on import, which ensures that all entry data structures in the directory are consistent.
LDIF
LDIF (LDAP Data Interchange Format) is a text format for LDAP database information, used for importing and exporting data; every line is “attribute: value”
Installation
OpenLDAP [2] is an open source implementation of LDAP, made up of three main parts:
slapd - the LDAP service daemon
libraries - libraries implementing the LDAP protocol
ldap-utils - ldapsearch, ldapadd, ldapdelete, ldapmodify, etc.
OpenLDAP stores data in a backend database, using the mdb database by default.
apt-get install slapd ldap-utils
After installation, slapd needs to be reconfigured
dpkg-reconfigure slapd
Omit OpenLDAP server configuration? No
DNS domain name? lfzyx.org
Organization name? lfzyx
Administrator password? the admin password
Database backend? MDB
Remove the database when slapd is purged? No
Move old database? Yes
Allow LDAPv2 protocol? No
Configuration
OpenLDAP’s configuration file is an ldif-format file under the /etc/ldap/slapd.d/cn=config directory. [3]
LDIF
LDIF files are used to manipulate or modify data [4]
Adding
Adding a Marketing department
vi add_entry.ldif
dn: ou=Marketing, dc=example,dc=com
objectclass: top
objectclass: organizationalUnit
ou: Marketing
ldapmodify -a -xWD 'cn=admin,dc=lfzyx,dc=org' -f add_entry.ldif
Modifying
Add the mail attribute, change the value of sn, delete the description attribute
vi modify_entry.ldif
dn: cn=Pete Minsky,ou=Marketing,dc=example,dc=com
changetype: modify
add: mail
mail: pminsky@example.com
replace: sn
sn: Minsky
delete: description
description: sx
ldapmodify -xWD 'cn=admin,dc=example,dc=com' -f modify_entry.ldif
Graphical interface
Although LDAP data can be managed from the command line, using Apache Directory Studio is more convenient
References