Learn LDAP - Architecture & Core Concepts

#Introduction

Episode 1 explained why directory services were born. Episode 2 dissects how they work inside — this is the episode with the most vocabulary in the series. You'll get to know the Directory Information Tree, entries, distinguished names, attributes, object classes, and schema as a single whole; understand the hierarchical structure from the Root DSE down to users; then look at the protocol basics and the nine LDAP operations. It's a dense episode, but every term here will keep being used until the end of the series.

#The LDAP Data Model

All LDAP data is made up of interrelated concepts:

• Directory Information Tree (DIT) — the tree structure where all directory data hangs, branching from the root to the entries below it.
• Entries — objects in the directory; the smallest unit of data that can be searched and changed. A simple analogy: one entry is one record.
• Distinguished Name (DN) — the unique address of an entry, describing the path from the root to that entry. Covered in depth in episode 4.
• Relative Distinguished Name (RDN) — the DN component that distinguishes an entry from its siblings at the same position.
• Attributes and values — each entry contains attribute-value pairs, for example mail: budi@example.com.
• Object classes — the framework that determines which attributes an entry may and must have.
• Schema — the overall rules of the game: attribute syntax, object classes, and matching rules. Episode 3 covers it thoroughly.

#Hierarchical Structure

The DIT resembles an upside-down tree. At its peak sits the Root DSE (Directory Server Entry) — a special entry containing information about the server itself, not business data. Below it sit common hierarchical elements:

• Domain components (dc) — pieces of a domain, for example dc=example and dc=com.
• Organizational units (ou) — organizational units such as ou=users or ou=groups.
• Common names (cn) — common names, used for objects such as people or groups.
• User IDs (uid) — user identifiers, usually part of an account's DN.

Picture this structure as a family tree: dc=example,dc=com is the grandparent, ou=users is the parent, and uid=budi,ou=users,dc=example,dc=com is the child. This tree concept is standard in LDAP; the term forest is more familiar in the Active Directory world as a collection of mutually trusting trees.

Drawn out, the structure above looks like this:

dc=example,dc=com
├── cn=admin
├── ou=users
│   ├── uid=budi
│   └── uid=siti
└── ou=groups
    └── cn=developers

Each branch is an entry, and every entry has a DN that reflects its position in the tree. uid=siti above has the DN uid=siti,ou=users,dc=example,dc=com.

#Data Model: LDAP vs Relational

Episode 1 compared directories and databases; now the comparison is more specific:

The most striking difference is in relations: in a tree, relations are implied by an entry's position; in tables, relations must be defined and explicitly joined.

#LDAP Protocol Basics

LDAP is a protocol that runs over TCP with a client-server pattern:

• Client-server model — clients send requests, servers answer. There's no initiative from the server side.
• Connection-oriented — communication happens over a TCP connection that is explicitly opened and closed.
• Default ports — worth memorizing these ports:

• Request-response pattern — every client operation is answered with a result operation from the server, possibly accompanied by many result entries.
• Session management — a session starts with a bind and ends with an unbind; the server maintains client state while the session is active.

#LDAP Operations

The LDAP protocol defines nine core operations:

An important note: Bind and Unbind aren't data-manipulating operations; they manage sessions. Compare is used to verify a single value without pulling the entire entry. These nine operations map onto the tools covered in episode 6.

#LDAP Implementations

LDAP is an open standard, so many implementations follow it:

• OpenLDAP — open source, the most popular, the main subject of this series.
• Microsoft Active Directory — a directory plus many integrated Windows features.
• 389 Directory Server — Red Hat's implementation.
• Apache Directory Server — a Java-based LDAP server.
• Oracle Internet Directory — Oracle's commercial product.
• IBM Security Directory Server — IBM's commercial product.
• FreeIPA — a complete identity management system built on LDAP and Kerberos.

All implementations speak the same LDAP protocol, so any client can talk to any server as long as the standard is followed. That's the power of an open standard: identity portability across vendors and platforms — Linux on the server side, Windows on the client side, and vice versa.

#Closing

Episode 2 gives you the complete LDAP map: the data model from DIT to schema, the hierarchical structure from the Root DSE to uid, protocol basics on ports 389 and 636, the nine core operations, and the implementation landscape where OpenLDAP is the star.

Key takeaways:

• dn: is an entry's unique address; the RDN is its last component.
• The tree structure is what distinguishes LDAP from relational databases.
• 389 for plain LDAP, 636 for LDAPS.
• Nine operations are the basis of every tool you'll use.

In the next episode, episode 3, you dive into the directory's rulebook: schema — how attribute types, object classes, and matching rules determine what can and cannot live inside your DIT.