intro.sdf 14.1 KB
Newer Older
Kurt Zeilenga's avatar
Kurt Zeilenga committed
1
# $OpenLDAP$
Kurt Zeilenga's avatar
Kurt Zeilenga committed
2
# Copyright 1999-2000, The OpenLDAP Foundation, All Rights Reserved.
Kurt Zeilenga's avatar
Kurt Zeilenga committed
3
# COPYING RESTRICTIONS APPLY, see COPYRIGHT.
4
H1: Introduction to OpenLDAP Directory Services
5

6
7
8
9
10
This document describes how to build, configure, and operate OpenLDAP
software to provide directory services.  This includes details on
how to configure and run the stand-alone {{TERM:LDAP}} daemon,
{{slapd}}(8) and the stand-alone LDAP update replication daemon,
{{slurpd}}(8). It is intended for newcomers and experienced
Kurt Zeilenga's avatar
Kurt Zeilenga committed
11
12
13
administrators alike.  This section provides a basic introduction
to directory services and, in particular, the directory services
provided by {{slapd}}(8).
14
15
16
17
18



H2: What is a directory service?

Kurt Zeilenga's avatar
Kurt Zeilenga committed
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
A directory is specialized database optimized for reading, browsing
and searching.  Directories tend to contain descriptive, attribute-based
information and support sophisticated filtering capabilities.
Directories generally do not support complicated transaction or
roll-back schemes found in database management systems designed
for handling high-volume complex updates.  Directory updates are
typically simple all-or-nothing changes, if they are allowed at
all.  Directories are tuned to give quick-response to high-volume
lookup or search operations. They may have the ability to replicate
information widely in order to increase availability and reliability,
while reducing response time.  When directory information is
replicated, temporary inconsistencies between the replicas may be
okay, as long as they get in sync eventually.

There are many different ways to provide a directory service.
Different methods allow different kinds of information to be stored
in the directory, place different requirements on how that information
can be referenced, queried and updated, how it is protected from
unauthorized access, etc.  Some directory services are {{local}},
providing service to a restricted context (e.g., the finger service
on a single machine). Other services are global, providing service
to a much broader context (e.g., the entire Internet).  Global
services are usually {{distributed}}, meaning that the data they
contain is spread across many machines, all of which cooperate to
provide the directory service. Typically a global service defines
a uniform {{namespace}} which gives the same view of the data no
matter where you are in relation to the data itself.  The Internet
{{TERM[expand]DNS}} is an example of a globally distributed directory
service.
48
49
50
51


H2: What is LDAP?

Kurt Zeilenga's avatar
Kurt Zeilenga committed
52
53
54
55
56
{{TERM:LDAP}} stands for {{TERM[expand]LDAP}}.  As the name suggests,
it is a lightweight protocol for accessing directory services,
specifically {{TERM:X.500}}-based directory services.  LDAP runs
over {{TERM:TCP}}/{{TERM:IP}} or other connection oriented transfer
services.  The nitty-gritty details of LDAP are defined in
57
58
{{REF:RFC2251}} "The Lightweight Directory Access Protocol (v3)."
This section gives an overview of LDAP from a user's perspective.
59

Kurt Zeilenga's avatar
Kurt Zeilenga committed
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
{{What kind of information can be stored in the directory?}} The
LDAP information model is based on {{entries}}. An entry is a
collection of attributes that has a globally-unique {{TERM[expand]DN}}
(DN).  The DN is used to refer to the entry unambiguously. Each of
the entry's attributes has a {{type}} and one or more {{values}}.
The types are typically mnemonic strings, like "{{EX:cn}}" for
common name, or "{{EX:mail}}" for email address. The syntax of
values depend on the attribute type is.  For example, {{EX:cn}}
attribute might be the value {{EX:Babs Jensen}}.  A {{EX:mail}}
attribute might contain the value "{{EX:babs@example.com}}". A
{{EX:jpegPhoto}} attribute would contain a photograph in the JPEG
(binary) format.

{{How is the information arranged?}} In LDAP, directory entries
are arranged in a hierarchical tree-like structure.  Traditionally,
this structure reflected the geographic and/or organizational
boundaries.  Entries representing countries appeared at the top of
the tree. Below them are entries representing states and national
organizations. Below them might be entries representing organizational
units, people, printers, documents, or just about anything else
you can think of.  Figure 1.1 shows an example LDAP directory tree
using traditional naming.
82

83
84
!import "intro_tree.gif"; align="center"; \
	title="LDAP directory tree (traditional naming)"
Kurt Zeilenga's avatar
Kurt Zeilenga committed
85
FT[align="Center"] Figure 1.1: LDAP directory tree (traditional naming)
86

Kurt Zeilenga's avatar
Kurt Zeilenga committed
87
88
89
The tree may also be arranged based upon Internet domain names.
This naming approach is becoming increasing popular as it allows
for directory services to be locating using the {{TERM[expand]DNS}}.
Kurt Zeilenga's avatar
Kurt Zeilenga committed
90
91
Figure 1.2 shows an example LDAP directory tree using domain-based
naming.
92

93
94
!import "intro_dctree.gif"; align="center"; \
	title="LDAP directory tree (Internet naming)"
Kurt Zeilenga's avatar
Kurt Zeilenga committed
95
FT[align="Center"] Figure 1.2: LDAP directory tree (Internet naming)
96

Kurt Zeilenga's avatar
Kurt Zeilenga committed
97
In addition, LDAP allows you to control which attributes are required
Kurt Zeilenga's avatar
Kurt Zeilenga committed
98
99
100
101
102
103
104
105
106
107
and allowed in an entry through the use of a special attribute
called {{EX:objectClass}}.  The values of the {{EX:objectClass}}
attribute determine the {{schema}} rules the entry must obey.

{{How is the information referenced?}} An entry is referenced by
its distinguished name, which is constructed by taking the name of
the entry itself (called the {{TERM[expand]RDN}} or RDN) and
concatenating the names of its ancestor entries. For example, the
entry for Barbara Jensen in the Internet naming example above has
an RDN of {{EX:uid=babs}} and a DN of
Kurt Zeilenga's avatar
Kurt Zeilenga committed
108
{{EX:uid=babs,ou=People,dc=example,dc=com}}. The full DN format
Kurt Zeilenga's avatar
Kurt Zeilenga committed
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
is described in {{REF:RFC2253}}, "Lightweight Directory Access
Protocol (v3):  UTF-8 String Representation of Distinguished Names."

{{How is the information accessed?}} LDAP defines operations for
interrogating and updating the directory.  Operations are provided
for adding and deleting an entry from the directory, changing an
existing entry, and changing the name of an entry. Most of the
time, though, LDAP is used to search for information in the directory.
The LDAP search operation allows some portion of the directory to
be searched for entries that match some criteria specified by a
search filter. Information can be requested from each entry that
matches the criteria.

For example, you might want to search the entire directory subtree
at and below {{EX:dc=example,dc=com}} for people with the name
{{EX:Barbara Jensen}}, retrieving the email address of each entry
found. LDAP lets you do this easily.  Or you might want to search
the entries directly below the {{EX:st=California,c=US}} entry for
organizations with the string {{EX:Acme}} in their name, and that
have a fax number. LDAP lets you do this too. The next section
describes in more detail what you can do with LDAP and how it might
be useful to you.

{{How is the information protected from unauthorized access?}} Some
directory services provide no protection, allowing anyone to see
Howard Chu's avatar
Howard Chu committed
134
the information. LDAP provides a mechanism for a client to
Kurt Zeilenga's avatar
Kurt Zeilenga committed
135
authenticate, or prove its identity to a directory server, paving
Kurt Zeilenga's avatar
Kurt Zeilenga committed
136
137
the way for rich access control to protect the information the
server contains.  LDAP also supports privacy and integrity security
Kurt Zeilenga's avatar
Kurt Zeilenga committed
138
services.
139
140
141
142


H2: How does LDAP work?

Kurt Zeilenga's avatar
Kurt Zeilenga committed
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
LDAP directory service is based on a {{client-server}} model. One
or more LDAP servers contain the data making up the directory
information tree (DIT).  The client connects to servers and
asks it a question.  The server responds with an answer and/or 
with a pointer to where the client can get additional information
(typically, another LDAP server).  No matter which LDAP server a
client connects to, it sees the same view of the directory; a name
presented to one LDAP server references the same entry it would at
another LDAP server. This is an important feature of a global
directory service, like LDAP.


H2: What about X.500?

Technically, {{TERM:LDAP}} is a directory access protocol to an
{{TERM:X.500}} directory service, the {{TERM:OSI}} directory service.
Initially, LDAP clients accessed gateways to directory service.
This gateway ran LDAP (between the client and gateway) and X.500's
{{TERM[expand]DAP}} ({{TERM:DAP}}) (between the gateway and the
X.500 server.  DAP is a heavyweight protocol that operates over a
full OSI protocol stack and requires a significant amount of
computing resources.  LDAP is designed to operate over
{{TERM:TCP}}/{{TERM:IP}} and provides most of the functionality of
DAP at a much lower cost.

While LDAP is still used to access X.500 directory service via
gateways, LDAP is now more commonly directly implemented in X.500
servers. 

The stand-alone LDAP daemon, or {{slapd}}(8), can be viewed as a
{{lightweight}} X.500 directory server.  That is, it does not
implement the X.500's DAP.  As a {{lightweight directory}} server,
{{slapd}}(8) implements only a subset of the X.500 models.

If you are already running a X.500 DAP service and you want to
continue to do so, you can probably stop reading this guide.  This
guide is all about running LDAP via {{slapd}}(8), without running
X.500 DAP.  If you are not running X.500 DAP, want to stop running
X.500 DAP, or have no immediate plans to run X.500 DAP, read on.

It is possible to replicate data from an LDAP directory server to
a X.500 DAP {{TERM:DSA}}.  This requires an LDAP/DAP gateway.
OpenLDAP does not provide such a gateway, but our replication daemon
can be used to replicate to such a gateway.  See the {{SECT:Replication
with slurpd}} chapter of this document for information regarding
replication.


H2: What the difference between LDAPv2 and LDAPv3?

Kurt Zeilenga's avatar
Kurt Zeilenga committed
193
194
LDAPv3 was developed in late 1990's to replace LDAPv2.
LDAPv3 adds the following features to LDAP:
Kurt Zeilenga's avatar
Kurt Zeilenga committed
195
196
197
198
199
200
201
202

 - Strong Authentication via {{TERM:SASL}}
 - Integrity and Confidential Protections via {{TERM:TLS}} (SSL)
 - Internationalization through the use of Unicode
 - Referrals and Continuations
 - Extensibility (controls and extended operations)
 - Schema Discovery

Kurt Zeilenga's avatar
Kurt Zeilenga committed
203
LDAPv2 is considered historical.  As deploying both LDAPv2 and
Kurt Zeilenga's avatar
Kurt Zeilenga committed
204
LDAPv3 simultaneously can be quite problematic, LDAPv2 should
Kurt Zeilenga's avatar
Kurt Zeilenga committed
205
be avoided.
206
207
208
209


H2: What is slapd and what can it do?

Kurt Zeilenga's avatar
Kurt Zeilenga committed
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
{{slapd}}(8) is an LDAP directory server that runs on many different
platforms. You can use it to provide a directory service of your
very own.  Your directory can contain pretty much anything you want
to put in it. You can connect it to the global LDAP directory
service, or run a service all by yourself. Some of slapd's more
interesting features and capabilities include:

{{B:LDAPv3}}: {{slapd}} implements version 3 of {{TERM[expand]LDAP}}.
{{slapd}} supports LDAP over both IPv4 and IPv6.

{{B:{{TERM[expand]SASL}}}}: {{slapd}} supports strong authentication
services through the use of SASL.  {{slapd}}'s SASL implementation
utilizes {{PRD:Cyrus}} {{PRD:SASL}} software which supports a number
of mechanisms including DIGEST-MD5, EXTERNAL, and GSSAPI.

{{B:{{TERM[expand]TLS}}}}: {{slapd}} provides privacy and integrity
protections through the use of TLS (or SSL).  {{slapd}}'s TLS
implementation utilizes {{PRD:OpenSSL}} software.

{{B:Topology control}}: {{slapd}} allows one to restrict access to
the server based upon network topology.  This feature utilizes
{{TCP wrappers}}.

{{B:Access control}}: {{slapd}} provides a rich and powerful access
control facility, allowing you to control access to the information
in your database(s). You can control access to entries based on
236
LDAP authorization information, {{TERM:IP}} address, domain name
Kurt Zeilenga's avatar
Kurt Zeilenga committed
237
238
and other criteria.  {{slapd}} supports both {{static}} and
{{dynamic}} access control information.
239
240
241
242

{{B:Internationalization}}: {{slapd}} supports Unicode and language
tags.

Kurt Zeilenga's avatar
Kurt Zeilenga committed
243
244
{{B:Choice of databases}}: {{slapd}} comes with a variety of
different backend databases you can choose from. They include
245
{{TERM:LDBM}}, a high-performance disk-based embedded database;
Kurt Zeilenga's avatar
Kurt Zeilenga committed
246
247
248
SHELL, a database interface to arbitrary shell scripts; and PASSWD,
a simple password file database.  LDBM utilizes either {{PRD:BerkeleyDB}}
or {{PRD:GDBM}}.
249

Kurt Zeilenga's avatar
Kurt Zeilenga committed
250
251
252
253
254
{{B:Multiple database instances}}: {{slapd}} can be configured to
serve multiple databases at the same time. This means that a single
{{slapd}} server can respond to requests for many logically different
portions of the LDAP tree, using the same or different backend
databases.
255

256
{{B:Generic modules API}}: If you require even more customization,
Kurt Zeilenga's avatar
Kurt Zeilenga committed
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
{{slapd}} lets you write your own modules easily. {{slapd}} consists
of two distinct parts: a front end that handles protocol communication
with LDAP clients; and modules which handle specific tasks such as
database operations. Because these two pieces communicate via a
well-defined {{TERM:C}} {{TERM:API}}, you can write your own
customized modules which extend {{slapd}} in numerous ways.  Also,
a number of {{programmable database}} modules are provided.  These
allow you to expose external data sources to {{slapd}} using popular
programming languages ({{PRD:Perl}}, {{Shell}}, {{PRD:SQL}}, and
{{PRD:TCL}}).

{{B:Threads}}: {{slapd}} is threaded for high performance. A single
multi-threaded {{slapd}} process handles all incoming requests,
reducing the amount of system overhead required.

{{B:Replication}}: {{slapd}} can be configured to maintain replica
273
274
275
copies of its database. This {{single-master/multiple-slave}}
replication scheme is vital in high-volume environments where a
single {{slapd}} just doesn't provide the necessary availability
Kurt Zeilenga's avatar
Kurt Zeilenga committed
276
277
or reliability.  {{slapd}} also includes experimental support for
{{multi-master}} replication.
278

Kurt Zeilenga's avatar
Kurt Zeilenga committed
279
280
281
{{B:Configuration}}: {{slapd}} is highly configurable through a
single configuration file which allows you to change just about
everything you'd ever want to change.  Configuration options have
282
283
reasonable defaults, making your job much easier.

Kurt Zeilenga's avatar
Kurt Zeilenga committed
284
{{slapd}} also has its limitations, of course.  The main LDBM
Kurt Zeilenga's avatar
Kurt Zeilenga committed
285
database backend does not handle range queries or negation queries
Kurt Zeilenga's avatar
Kurt Zeilenga committed
286
very well.
287
288
289
290


H2: What is slurpd and what can it do?

Kurt Zeilenga's avatar
Kurt Zeilenga committed
291
292
293
294
295
296
297
298
{{slurpd}}(8) is a daemon that helps {{slapd}} provide replicated
service. It is responsible for distributing changes made to the
master {{slapd}} database out to the various {{slapd}} replicas.
It frees {{slapd}} from having to worry that some replicas might
be down or unreachable when a change comes through; {{slurpd}}
handles retrying failed requests automatically.  {{slapd}} and
{{slurpd}} communicate through a simple text file that is used to
log changes.
299
300
301

See the {{SECT:Replication with slurpd}} chapter for information
about how to configure and run {{slurpd}}(8).