Introduction to LDAP Protocol
LDAP (Lightweight Directory Access Protocol) is a network based protocol used by various suppliers of systems to provide directory services.
A client starts an LDAP session by connecting to an LDAP server, called a Directory System Agent (DSA). The client then sends an operation request to the server, and the server sends responses in return. With some exceptions, the client does not need to wait for a response before sending the next request, and the server may send the responses in any order.
The client may request the following operations:
| Operation | Description |
|---|---|
| StartTLS | Use Transport Layer Security (TLS) extension for a secure connection |
| Bind | Authenticate and specify LDAP protocol version |
| Search | Search for and/or retrieve directory entries |
| Compare | Test if a named entry contains a given attribute value |
| Add | Add a new entry |
| Delete | Delete an entry |
| Modify | Modify an entry |
| Modify Distinguished Name (DN) | Move or rename an entry |
| Abandon | Abort a previous request |
| Extended Operation | Generic operation used to define other operations |
| Unbind | Close the connection (Not the inverse of "Bind") |
Directory structure:
The protocol provides an interface with directories:
- An entry consists of a set of attributes.
- An attribute has a name (an attribute type or attribute description) and one or more values. The attributes are defined in a schema (see below).
- Each entry has a unique identifier: its Distinguished Name (DN). This consists of its Relative Distinguished Name (RDN), constructed from some attribute(s) in the entry, followed by the parent entry's DN. Think of the DN as the full file path and the RDN as its relative filename in its parent folder.
A DN may change over the lifetime of the entry, for instance, when entries are moved within a tree.
"dn" is the Distinguished Name of the entry, and as said above it's composed of "cn=Jan Jansen", the entry's RDN and "dc=example,dc=com" is the DN of the parent entry, it is not considered as an attribute.
| Mnemonic string | Attribute |
|---|---|
| dc | Domain Component |
| cn | Common Name |
| sn | Surname |