LDAP (Lightweight Directory Access Protocol) is a protocol for accessing and maintaining distributed directory information services. Used for authentication, authorization, and storing user/group information. Active Directory, OpenLDAP, and FreeIPA all implement LDAP.
| Item | Syntax / Value | Description |
|---|---|---|
| Directory | Hierarchical tree of entries — like a filesystem | LDAP stores data in a tree structure called the DIT |
| DIT | Directory Information Tree | The entire tree structure of LDAP entries |
| Entry | A single record in the directory | Like a row in a database — identified by its DN |
| DN | Distinguished Name: uid=alice,ou=users,dc=mwu,dc=com | Unique path to an entry — like a full filesystem path |
| RDN | Relative Distinguished Name: uid=alice | The leftmost component of a DN — unique among siblings |
| dc | Domain Component: dc=mywebuniversity,dc=com | Top-level domain components |
| ou | Organizational Unit: ou=users | Container for grouping entries |
| cn | Common Name: cn=Alice Smith | Full name of a person or object |
| uid | User ID: uid=alice | Unix-style username |
| sn | Surname: sn=Smith | Last name attribute |
| givenName | givenName: Alice | First name attribute |
| mail: alice@example.com | Email address attribute | |
| objectClass | objectClass: inetOrgPerson | Defines which attributes an entry must/may have |
| Schema | Defines objectClasses and attribute types | Rules for what attributes entries can have |
| inetOrgPerson | Person + organizational + internet attributes | Most common objectClass for user accounts |
| posixAccount | Unix account attributes: uid, gidNumber, homeDirectory | ObjectClass for Unix/Linux users |
| groupOfNames | Group objectClass with member DNs | Group containing member Distinguished Names |
| posixGroup | Unix group: gidNumber, memberUid | Unix group objectClass |
| LDIF | LDAP Data Interchange Format | Text format for importing/exporting LDAP data |
| Bind | Authenticate to the LDAP server | Like logging in — provide DN and password |
| Anonymous bind | Connect without credentials | Read-only access to public directory info |
| Simple bind | Provide DN + password in plaintext | Basic authentication — use TLS! |
| SASL bind | Simple Auth and Security Layer | Kerberos, GSSAPI, DIGEST-MD5 authentication |
| Base DN | Starting point for a search | The root of the search subtree |
| Search scope | base / one / sub (subtree) | How deep to search from base DN |
| Search filter | (objectClass=inetOrgPerson) | RFC 4515 filter expression for matching entries |
| LDAPS | LDAP over SSL/TLS on port 636 | Encrypted LDAP — always use in production |
| StartTLS | TLS upgrade on standard port 389 | Upgrade unencrypted connection to TLS |
| Referral | Redirect to another LDAP server | Distribute directory across servers |
| Replication | Master-replica or multi-master sync | Keep multiple LDAP servers synchronized |
# LDAP Directory Structure — conceptual overview
# Typical DIT (Directory Information Tree):
#
# dc=mywebuniversity,dc=com (root / base DN)
# ├── ou=users (organizational unit)
# │ ├── uid=alice,ou=users,dc=... (user entry)
# │ ├── uid=bob,ou=users,dc=...
# │ └── uid=carol,ou=users,dc=...
# ├── ou=groups (groups container)
# │ ├── cn=admins,ou=groups,dc=... (group entry)
# │ ├── cn=developers,ou=groups,dc=...
# │ └── cn=students,ou=groups,dc=...
# ├── ou=services (service accounts)
# │ └── uid=ldap-bind,ou=services,...
# └── ou=computers (computer accounts)
# └── cn=webserver01,ou=computers,...
# Distinguished Name examples:
# uid=alice,ou=users,dc=mywebuniversity,dc=com
# cn=admins,ou=groups,dc=mywebuniversity,dc=com
# cn=webserver01,ou=computers,dc=mywebuniversity,dc=com
# LDAP Search Filter examples:
# (objectClass=inetOrgPerson) -- all person entries
# (uid=alice) -- specific user
# (mail=*@mywebuniversity.com) -- email wildcard
# (&(objectClass=posixAccount)(uid=*)) -- AND filter
# (|(uid=alice)(uid=bob)) -- OR filter
# (!(uid=admin)) -- NOT filter
# (&(objectClass=inetOrgPerson)(sn=Smith)(givenName=Alice)) -- compound
# (memberOf=cn=admins,ou=groups,dc=mwu,dc=com) -- AD memberOf
# LDAP Attributes for a user entry:
# dn: uid=alice,ou=users,dc=mywebuniversity,dc=com
# objectClass: top
# objectClass: person
# objectClass: organizationalPerson
# objectClass: inetOrgPerson
# objectClass: posixAccount
# uid: alice
# cn: Alice Smith
# sn: Smith
# givenName: Alice
# displayName: Alice Smith
# mail: alice@mywebuniversity.com
# telephoneNumber: +1-555-0100
# title: Senior Developer
# departmentNumber: Engineering
# employeeNumber: 1001
# userPassword: {SSHA}hashedpassword
# uidNumber: 10001
# gidNumber: 5000
# homeDirectory: /home/alice
# loginShell: /bin/bash
# shadowLastChange: 19000
# shadowExpire: -1