intro.sdf 15.1 KB
Newer Older
Kurt Zeilenga's avatar
Kurt Zeilenga committed
1
# $OpenLDAP$
2
# Copyright 1999-2005, The OpenLDAP Foundation, All Rights Reserved.
Kurt Zeilenga's avatar
Kurt Zeilenga committed
3
# COPYING RESTRICTIONS APPLY, see COPYRIGHT.
4
H1: Introduction to OpenLDAP Directory Services
5

6
7
8
9
10
This document describes how to build, configure, and operate OpenLDAP
software to provide directory services.  This includes details on
how to configure and run the stand-alone {{TERM:LDAP}} daemon,
{{slapd}}(8) and the stand-alone LDAP update replication daemon,
{{slurpd}}(8). It is intended for newcomers and experienced
Kurt Zeilenga's avatar
Kurt Zeilenga committed
11
12
13
administrators alike.  This section provides a basic introduction
to directory services and, in particular, the directory services
provided by {{slapd}}(8).
14
15
16
17


H2: What is a directory service?

Howard Chu's avatar
Howard Chu committed
18
A directory is a specialized database optimized for reading, browsing
Kurt Zeilenga's avatar
Kurt Zeilenga committed
19
20
21
22
23
24
and searching.  Directories tend to contain descriptive, attribute-based
information and support sophisticated filtering capabilities.
Directories generally do not support complicated transaction or
roll-back schemes found in database management systems designed
for handling high-volume complex updates.  Directory updates are
typically simple all-or-nothing changes, if they are allowed at
Howard Chu's avatar
Howard Chu committed
25
all.  Directories are tuned to give quick response to high-volume
Kurt Zeilenga's avatar
Kurt Zeilenga committed
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
lookup or search operations. They may have the ability to replicate
information widely in order to increase availability and reliability,
while reducing response time.  When directory information is
replicated, temporary inconsistencies between the replicas may be
okay, as long as they get in sync eventually.

There are many different ways to provide a directory service.
Different methods allow different kinds of information to be stored
in the directory, place different requirements on how that information
can be referenced, queried and updated, how it is protected from
unauthorized access, etc.  Some directory services are {{local}},
providing service to a restricted context (e.g., the finger service
on a single machine). Other services are global, providing service
to a much broader context (e.g., the entire Internet).  Global
services are usually {{distributed}}, meaning that the data they
contain is spread across many machines, all of which cooperate to
provide the directory service. Typically a global service defines
a uniform {{namespace}} which gives the same view of the data no
matter where you are in relation to the data itself.  The Internet
Kurt Zeilenga's avatar
Kurt Zeilenga committed
45
46
{{TERM[expand]DNS}} (DNS) is an example of a globally distributed
directory service.
47
48
49
50


H2: What is LDAP?

Kurt Zeilenga's avatar
Kurt Zeilenga committed
51
52
53
54
55
{{TERM:LDAP}} stands for {{TERM[expand]LDAP}}.  As the name suggests,
it is a lightweight protocol for accessing directory services,
specifically {{TERM:X.500}}-based directory services.  LDAP runs
over {{TERM:TCP}}/{{TERM:IP}} or other connection oriented transfer
services.  The nitty-gritty details of LDAP are defined in
Kurt Zeilenga's avatar
Kurt Zeilenga committed
56
57
58
59
{{REF:RFC2251}} "The Lightweight Directory Access Protocol (v3)"
and other documents comprising the technical specification
{{REF:RFC3377}}.  This section gives an overview of LDAP from a
user's perspective.
60

Kurt Zeilenga's avatar
Kurt Zeilenga committed
61
62
63
64
65
66
67
{{What kind of information can be stored in the directory?}} The
LDAP information model is based on {{entries}}. An entry is a
collection of attributes that has a globally-unique {{TERM[expand]DN}}
(DN).  The DN is used to refer to the entry unambiguously. Each of
the entry's attributes has a {{type}} and one or more {{values}}.
The types are typically mnemonic strings, like "{{EX:cn}}" for
common name, or "{{EX:mail}}" for email address. The syntax of
Howard Chu's avatar
Howard Chu committed
68
69
values depend on the attribute type.  For example, a {{EX:cn}}
attribute might contain the value {{EX:Babs Jensen}}.  A {{EX:mail}}
Kurt Zeilenga's avatar
Kurt Zeilenga committed
70
71
72
73
74
75
76
attribute might contain the value "{{EX:babs@example.com}}". A
{{EX:jpegPhoto}} attribute would contain a photograph in the JPEG
(binary) format.

{{How is the information arranged?}} In LDAP, directory entries
are arranged in a hierarchical tree-like structure.  Traditionally,
this structure reflected the geographic and/or organizational
Howard Chu's avatar
Howard Chu committed
77
boundaries.  Entries representing countries appear at the top of
Kurt Zeilenga's avatar
Kurt Zeilenga committed
78
79
80
81
82
the tree. Below them are entries representing states and national
organizations. Below them might be entries representing organizational
units, people, printers, documents, or just about anything else
you can think of.  Figure 1.1 shows an example LDAP directory tree
using traditional naming.
83

84
85
!import "intro_tree.gif"; align="center"; \
	title="LDAP directory tree (traditional naming)"
Kurt Zeilenga's avatar
Kurt Zeilenga committed
86
FT[align="Center"] Figure 1.1: LDAP directory tree (traditional naming)
87

Kurt Zeilenga's avatar
Kurt Zeilenga committed
88
89
The tree may also be arranged based upon Internet domain names.
This naming approach is becoming increasing popular as it allows
Howard Chu's avatar
Howard Chu committed
90
for directory services to be located using the {{DNS}}.
Kurt Zeilenga's avatar
Kurt Zeilenga committed
91
92
Figure 1.2 shows an example LDAP directory tree using domain-based
naming.
93

94
95
!import "intro_dctree.gif"; align="center"; \
	title="LDAP directory tree (Internet naming)"
Kurt Zeilenga's avatar
Kurt Zeilenga committed
96
FT[align="Center"] Figure 1.2: LDAP directory tree (Internet naming)
97

Kurt Zeilenga's avatar
Kurt Zeilenga committed
98
In addition, LDAP allows you to control which attributes are required
Kurt Zeilenga's avatar
Kurt Zeilenga committed
99
100
101
102
103
104
105
106
107
108
and allowed in an entry through the use of a special attribute
called {{EX:objectClass}}.  The values of the {{EX:objectClass}}
attribute determine the {{schema}} rules the entry must obey.

{{How is the information referenced?}} An entry is referenced by
its distinguished name, which is constructed by taking the name of
the entry itself (called the {{TERM[expand]RDN}} or RDN) and
concatenating the names of its ancestor entries. For example, the
entry for Barbara Jensen in the Internet naming example above has
an RDN of {{EX:uid=babs}} and a DN of
Kurt Zeilenga's avatar
Kurt Zeilenga committed
109
{{EX:uid=babs,ou=People,dc=example,dc=com}}. The full DN format
Kurt Zeilenga's avatar
Kurt Zeilenga committed
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
is described in {{REF:RFC2253}}, "Lightweight Directory Access
Protocol (v3):  UTF-8 String Representation of Distinguished Names."

{{How is the information accessed?}} LDAP defines operations for
interrogating and updating the directory.  Operations are provided
for adding and deleting an entry from the directory, changing an
existing entry, and changing the name of an entry. Most of the
time, though, LDAP is used to search for information in the directory.
The LDAP search operation allows some portion of the directory to
be searched for entries that match some criteria specified by a
search filter. Information can be requested from each entry that
matches the criteria.

For example, you might want to search the entire directory subtree
at and below {{EX:dc=example,dc=com}} for people with the name
{{EX:Barbara Jensen}}, retrieving the email address of each entry
found. LDAP lets you do this easily.  Or you might want to search
the entries directly below the {{EX:st=California,c=US}} entry for
organizations with the string {{EX:Acme}} in their name, and that
have a fax number. LDAP lets you do this too. The next section
describes in more detail what you can do with LDAP and how it might
be useful to you.

{{How is the information protected from unauthorized access?}} Some
directory services provide no protection, allowing anyone to see
Howard Chu's avatar
Howard Chu committed
135
the information. LDAP provides a mechanism for a client to
Kurt Zeilenga's avatar
Kurt Zeilenga committed
136
authenticate, or prove its identity to a directory server, paving
Kurt Zeilenga's avatar
Kurt Zeilenga committed
137
138
the way for rich access control to protect the information the
server contains.  LDAP also supports privacy and integrity security
Kurt Zeilenga's avatar
Kurt Zeilenga committed
139
services.
140
141
142
143


H2: How does LDAP work?

Kurt Zeilenga's avatar
Kurt Zeilenga committed
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
LDAP directory service is based on a {{client-server}} model. One
or more LDAP servers contain the data making up the directory
information tree (DIT).  The client connects to servers and
asks it a question.  The server responds with an answer and/or 
with a pointer to where the client can get additional information
(typically, another LDAP server).  No matter which LDAP server a
client connects to, it sees the same view of the directory; a name
presented to one LDAP server references the same entry it would at
another LDAP server. This is an important feature of a global
directory service, like LDAP.


H2: What about X.500?

Technically, {{TERM:LDAP}} is a directory access protocol to an
{{TERM:X.500}} directory service, the {{TERM:OSI}} directory service.
Howard Chu's avatar
Howard Chu committed
160
161
162
Initially, LDAP clients accessed gateways to the X.500 directory service.
This gateway ran LDAP between the client and gateway and X.500's
{{TERM[expand]DAP}} ({{TERM:DAP}}) between the gateway and the
Kurt Zeilenga's avatar
Kurt Zeilenga committed
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
X.500 server.  DAP is a heavyweight protocol that operates over a
full OSI protocol stack and requires a significant amount of
computing resources.  LDAP is designed to operate over
{{TERM:TCP}}/{{TERM:IP}} and provides most of the functionality of
DAP at a much lower cost.

While LDAP is still used to access X.500 directory service via
gateways, LDAP is now more commonly directly implemented in X.500
servers. 

The stand-alone LDAP daemon, or {{slapd}}(8), can be viewed as a
{{lightweight}} X.500 directory server.  That is, it does not
implement the X.500's DAP.  As a {{lightweight directory}} server,
{{slapd}}(8) implements only a subset of the X.500 models.

If you are already running a X.500 DAP service and you want to
continue to do so, you can probably stop reading this guide.  This
guide is all about running LDAP via {{slapd}}(8), without running
X.500 DAP.  If you are not running X.500 DAP, want to stop running
X.500 DAP, or have no immediate plans to run X.500 DAP, read on.

It is possible to replicate data from an LDAP directory server to
a X.500 DAP {{TERM:DSA}}.  This requires an LDAP/DAP gateway.
OpenLDAP does not provide such a gateway, but our replication daemon
can be used to replicate to such a gateway.  See the {{SECT:Replication
with slurpd}} chapter of this document for information regarding
replication.


Howard Chu's avatar
Howard Chu committed
192
H2: What is the difference between LDAPv2 and LDAPv3?
Kurt Zeilenga's avatar
Kurt Zeilenga committed
193

Howard Chu's avatar
Howard Chu committed
194
LDAPv3 was developed in the late 1990's to replace LDAPv2.
Kurt Zeilenga's avatar
Kurt Zeilenga committed
195
LDAPv3 adds the following features to LDAP:
Kurt Zeilenga's avatar
Kurt Zeilenga committed
196

Kurt Zeilenga's avatar
Add HDB    
Kurt Zeilenga committed
197
198
 - Strong authentication and data security services via {{TERM:SASL}}
 - Certificate authentication and data security services via {{TERM:TLS}} (SSL)
Kurt Zeilenga's avatar
Kurt Zeilenga committed
199
200
201
 - Internationalization through the use of Unicode
 - Referrals and Continuations
 - Schema Discovery
202
 - Extensibility (controls, extended operations, and more)
Kurt Zeilenga's avatar
Kurt Zeilenga committed
203

Kurt Zeilenga's avatar
Add HDB    
Kurt Zeilenga committed
204
205
206
207
208
209
LDAPv2 is historic ({{REF:RFC3494}}).  As most {{so-called}} LDAPv2
implementations (including {{slapd}}(8)) do not conform to the
LDAPv2 technical specification, interoperatibility amongst
implementations claiming LDAPv2 support is limited.  As LDAPv2
differs significantly from LDAPv3, deploying both LDAPv2 and LDAPv3
simultaneously is quite problematic.  LDAPv2 should be avoided.
Kurt Zeilenga's avatar
Kurt Zeilenga committed
210
LDAPv2 is disabled by default.
211
212
213
214


H2: What is slapd and what can it do?

Kurt Zeilenga's avatar
Kurt Zeilenga committed
215
216
217
218
219
220
221
222
{{slapd}}(8) is an LDAP directory server that runs on many different
platforms. You can use it to provide a directory service of your
very own.  Your directory can contain pretty much anything you want
to put in it. You can connect it to the global LDAP directory
service, or run a service all by yourself. Some of slapd's more
interesting features and capabilities include:

{{B:LDAPv3}}: {{slapd}} implements version 3 of {{TERM[expand]LDAP}}.
Kurt Zeilenga's avatar
Kurt Zeilenga committed
223
{{slapd}} supports LDAP over both IPv4 and IPv6 and Unix IPC.
Kurt Zeilenga's avatar
Kurt Zeilenga committed
224
225
226
227
228
229
230
231
232
233

{{B:{{TERM[expand]SASL}}}}: {{slapd}} supports strong authentication
services through the use of SASL.  {{slapd}}'s SASL implementation
utilizes {{PRD:Cyrus}} {{PRD:SASL}} software which supports a number
of mechanisms including DIGEST-MD5, EXTERNAL, and GSSAPI.

{{B:{{TERM[expand]TLS}}}}: {{slapd}} provides privacy and integrity
protections through the use of TLS (or SSL).  {{slapd}}'s TLS
implementation utilizes {{PRD:OpenSSL}} software.

Kurt Zeilenga's avatar
Kurt Zeilenga committed
234
235
236
{{B:Topology control}}: {{slapd}} can be configured to restrict
access at the socket layer based upon network topology information.
This feature utilizes {{TCP wrappers}}.
Kurt Zeilenga's avatar
Kurt Zeilenga committed
237
238
239
240

{{B:Access control}}: {{slapd}} provides a rich and powerful access
control facility, allowing you to control access to the information
in your database(s). You can control access to entries based on
241
LDAP authorization information, {{TERM:IP}} address, domain name
Kurt Zeilenga's avatar
Add HDB    
Kurt Zeilenga committed
242
243
and other criteria.  {{slapd}} supports both {{static}} and {{dynamic}}
access control information.
244
245
246
247

{{B:Internationalization}}: {{slapd}} supports Unicode and language
tags.

Howard Chu's avatar
Howard Chu committed
248
{{B:Choice of database backends}}: {{slapd}} comes with a variety
Kurt Zeilenga's avatar
Kurt Zeilenga committed
249
250
of different database backends you can choose from. They include
{{TERM:BDB}}, a high-performance transactional database backend;
Kurt Zeilenga's avatar
Add HDB    
Kurt Zeilenga committed
251
{{TERM:HDB}}, a hierarchical high-performance transactional backend;
Kurt Zeilenga's avatar
Kurt Zeilenga committed
252
253
{{TERM:LDBM}}, a lightweight DBM based backend; {{SHELL}}, a backend
interface to arbitrary shell scripts; and PASSWD, a simple backend
Kurt Zeilenga's avatar
Add HDB    
Kurt Zeilenga committed
254
255
256
interface to the {{passwd}}(5) file.  The BDB and HDB backends
utilize {{ORG:Sleepycat}} {{PRD:Berkeley DB}}.  The LDBM utilizes
either {{PRD:Berkeley DB}} or {{PRD:GDBM}}.
257

Kurt Zeilenga's avatar
Kurt Zeilenga committed
258
259
260
{{B:Multiple database instances}}: {{slapd}} can be configured to
serve multiple databases at the same time. This means that a single
{{slapd}} server can respond to requests for many logically different
Kurt Zeilenga's avatar
Kurt Zeilenga committed
261
262
portions of the LDAP tree, using the same or different database
backends.
263

Kurt Zeilenga's avatar
Kurt Zeilenga committed
264
{{B:Generic modules API}}:  If you require even more customization,
Kurt Zeilenga's avatar
Kurt Zeilenga committed
265
266
267
{{slapd}} lets you write your own modules easily. {{slapd}} consists
of two distinct parts: a front end that handles protocol communication
with LDAP clients; and modules which handle specific tasks such as
Kurt Zeilenga's avatar
Add HDB    
Kurt Zeilenga committed
268
database operations.  Because these two pieces communicate via a
Kurt Zeilenga's avatar
Kurt Zeilenga committed
269
270
271
272
well-defined {{TERM:C}} {{TERM:API}}, you can write your own
customized modules which extend {{slapd}} in numerous ways.  Also,
a number of {{programmable database}} modules are provided.  These
allow you to expose external data sources to {{slapd}} using popular
Kurt Zeilenga's avatar
Kurt Zeilenga committed
273
programming languages ({{PRD:Perl}}, {{shell}}, {{PRD:SQL}}, and
Kurt Zeilenga's avatar
Kurt Zeilenga committed
274
275
{{PRD:TCL}}).

Kurt Zeilenga's avatar
Kurt Zeilenga committed
276
{{B:Threads}}: {{slapd}} is threaded for high performance.  A single
Kurt Zeilenga's avatar
Add HDB    
Kurt Zeilenga committed
277
278
multi-threaded {{slapd}} process handles all incoming requests using
a pool of threads.  This reduces the amount of system overhead
Howard Chu's avatar
Howard Chu committed
279
required while providing high performance.
Kurt Zeilenga's avatar
Kurt Zeilenga committed
280

Kurt Zeilenga's avatar
Kurt Zeilenga committed
281
282
{{B:Replication}}: {{slapd}} can be configured to maintain shadow
copies of directory information.  This {{single-master/multiple-slave}}
283
284
replication scheme is vital in high-volume environments where a
single {{slapd}} just doesn't provide the necessary availability
Kurt Zeilenga's avatar
Kurt Zeilenga committed
285
or reliability.  {{slapd}} also includes experimental support for
Kurt Zeilenga's avatar
Kurt Zeilenga committed
286
287
{{multi-master}} replication (for use where strong ACID properties
are not required).  {{slapd}} supports two replication methods:
Kurt Zeilenga's avatar
Kurt Zeilenga committed
288
{{LDAP Sync}}-based and {{slurpd}}(8)-based replication .
Kurt Zeilenga's avatar
Kurt Zeilenga committed
289

Kurt Zeilenga's avatar
Kurt Zeilenga committed
290
291
{{B:Proxy Cache}}: {{slapd}} can be configured as a caching
LDAP proxy service.
292

Kurt Zeilenga's avatar
Kurt Zeilenga committed
293
294
295
{{B:Configuration}}: {{slapd}} is highly configurable through a
single configuration file which allows you to change just about
everything you'd ever want to change.  Configuration options have
296
297
298
299
300
reasonable defaults, making your job much easier.


H2: What is slurpd and what can it do?

Kurt Zeilenga's avatar
Kurt Zeilenga committed
301
302
303
304
305
{{slurpd}}(8) is a daemon that, with {{slapd}} help, provides
replicated service.  It is responsible for distributing changes
made to the master {{slapd}} database out to the various {{slapd}}
replicas.  It frees {{slapd}} from having to worry that some replicas
might be down or unreachable when a change comes through; {{slurpd}}
Kurt Zeilenga's avatar
Kurt Zeilenga committed
306
307
308
handles retrying failed requests automatically.  {{slapd}} and
{{slurpd}} communicate through a simple text file that is used to
log changes.
309
310
311

See the {{SECT:Replication with slurpd}} chapter for information
about how to configure and run {{slurpd}}(8).
Kurt Zeilenga's avatar
Kurt Zeilenga committed
312
313
314
315
316

Alternatively, {{LDAP-Sync}}-based replication may be used to provide
a replicated service.  See the {{SECT:LDAP Sync Replication}} chapter
for details.