A directory service is an application(s) that stores, retrieves, and modifies information about network resources such as network users. The actual data is stored in a database; a database service is an abstract layer on top of the database. The Lightweight Directory Access Protocol (LDAP) is a lightweight protocol for accessing directory services. LDAP is based on entries; an entry is a set of attributes identified by a globally unique Distinguished Name (DN). Each of a directory entry's attributes has a type and one or more values. The attributes in a directory entry's distinguished name(DN) are arranged in a hierarchy from right to left with the rightmost attribute as the top entry and with the leftmost attribute(s) that are unique to its level called a Relative Distinguished Name (RDN). A DN is a sequence of RDNs. Some examples of attribute types are discussed in Table 1.
An entry in a directory is identified by a distinguished name (DN). An example of a directory entry's distinguished name is:
cn=dvohra,ou=People,dc=example,dc=com
In the example DN, the base entry/root is "dc=example,dc=com." The relative distinguished name is "cn=dvohra." LDAP defines operations for adding, searching, modifying, and deleting directory entries. An LDAP server is required to provide a LDAP directory service. OpenLDAP is an open source software package that includes a LDAP directory server (slapd). OpenLDAP is built on top of the Berkeley DB, an embedded database. In this article we'll create a directory service using the OpenLDAP directory server.
Installing OpenLDAP
Download OpenLDAP for Windows. Double-click on the OpenLDAP application openldap-2.2.29-db-4.3.29-openssl-0.9.8a-BDB_ONLY-win32_Setup.exe. The OpenLDAP setup wizard gets started as shown in Figure 1. Click on the Next button.
Accept the license agreement and click on the Next button. Select the default destination, C:\Program Files\OpenLDAP and click on the Next button. Select components BDB-tools and OpenLDAP-slapd as NT service and click on Next as shown in Figure 2.
Specify a Start Menu folder and click on Next. Select additional tasks such as "automatically start OpenLDAP NT service after reboot" and "Create a desktop item" and click on Next. Click on the Install button to install OpenLDAP as shown in Figure 3.
Configuring OpenLDAP
The configuration for a slapd server is specified in the slapd.conf configuration file. Configuration information comes in three types: global, back-end and database. The configuration information is specified with directives; the global directives precede the back-end directives that precede the database directives.
The global directives apply to all back-ends and database types. Some of the commonly used global directives are discussed in Table 2
Back-end directives specify a back-end and apply to all database instances in a back-end. The commonly used back-end directive is as follows:
backend <type>
The back-end directive specifies a back-end declaration. Some of the back-end types are bdb (Berkeley DB transactional back-end) and sql (SQL programmable back-end).
Database directives specify information about a database instance. Some of the commonly used database directives are discussed in Table 3.
Next, we'll modify the directives in the slapd.conf file in the C:\Program Files\OpenLDAP directory of the OpenLDAP server we installed earlier. The database directive is already set to bdb for the Berkeley DB database. Set the suffix, rootdn, and rootpw as shown in following listing:
database bdb
suffix "dc=example,dc=com"
rootdn "cn=Manager,dc=example,dc=com"
rootpw openldap
directory ./data
Creating a Directory
Next, we'll create a directory in the OpenLDAP LDAP server. For example, create a directory of JDeveloper developers. LDAP entries are represented in the LDAP Data Interchange Format (LDIF) in an .ldif format. The format of an entry in n LDIF file is as follows:
#comment
dn: <distinguished name>
<attrdesc>: <attrvalue>
<attrdesc>: <attrvalue>
Create a jdevDir.ldif file for a directory of JDeveloper developers. A root/base DN was specified in the slapd.conf file with the suffix directive:
suffix "dc=example,dc=com"
In the .ldif file add an entry for the base DN. Each directory entry is identified with a dn attribute. The objectClass attributes specify the type of data, and required and optional attributes in an entry. Object classes form a class hierarchy and some of the commonly used object classes are top, organization, and organizationalPerson. The object classes that may be specified in a directory entry and the attributes that may be specified or have to be specified for an object class are listed in the C:\Program Files\OpenLDAP\schema\core.schema file:
dn: dc=example,dc=com
objectClass: top
objectClass: dcObject
objectClass: organization
dc :example
o: Oracle
Next, add an entry for an organizational unit called jdeveloper under dc=example, dc=com. Directory entries in an LDIF file are separated with a blank line.
dn: ou=jdeveloper, dc=example, dc=com
objectClass: organizationalUnit
ou: jdeveloper
Next, create directory entries for JDeveloper developers under the organizational unit jdeveloper. Attributes sn and cn are required attributes for the object class person. An example directory entry is shown in following listing:
#Steve's Directory Entry
dn: cn=Steve Muench,ou=jdeveloper,dc=example,dc=com
objectclass: top
objectclass: person
objectclass: organizationalPerson
cn: Steve Muench
sn: Muench
title: JDeveloper Developer
The LDIF file jdevDir.ldif is listed in Listing 1. Copy the ldif file to the C:\Program Files\OpenLDAP directory. Next, start the OpenLDAP slapd server with the following command from the OpenLDAP installation directory:
C:\Program Files\OpenLDAP> .\slapd -d 1
OpenLDAP provides the ldapadd tool to add a directory entry. Run the ldapadd command on the jdevDir.ldif file as shown below. The -d argument specifies the bind DN for authenticating the connection to the directory. The -w argument specifies the password for authenticating to the bind DN. The -file argument specifies the LDIF file that contains the directory entries.
C:\Program Files\OpenLDAP>ldapadd -D "cn=Manager,dc=example,dc=com" -v -w openldap -f jdevDir.ldif
Directory entries get added to the LDAP server.
Searching a Directory
The ldapsearch tool is used
to search an LDAP directory and display the results in LDIF text
format. As directory entries are identified by DNs, directory entries
are searched by DNs. As an example, search the directory for DN
"cn=Steve Muench,ou=jdeveloper,dc=example,dc=com." The ldap command to
authenticate to the base DN and search the directory entry for DN
"cn=Steve Muench,ou=jdeveloper,dc=example,dc=com" is as follows:
>ldapsearch -D "cn=Manager,dc=example,dc=com" -w openldap -b "cn=Steve Muench,ou=jdeveloper,dc=example,dc=com"
The -b argument specifies the base DN to search. The output of the ldapsearch operation is listed below.
# extended LDIF
#
# LDAPv3
# base <cn=Steve Muench,ou=jdeveloper,dc=example,dc=com> with scope sub
# filter: (objectclass=*)
# requesting: ALL
#
# Steve Muench, jdeveloper, example.com
dn: cn=Steve Muench,ou=jdeveloper,dc=example,dc=com
objectClass: top
objectClass: person
objectClass: organizationalPerson
cn: Steve Muench
sn: Muench
title: JDeveloper Developer
# search result
search: 2
result: 0 Success
# numResponses: 2
# numEntries: 1
Modifying a Directory
OpenLDAP provides the
ldapmodify tool to modify a directory. With the ldapmodify tool a new
entry can be added, an entry can be modified, and an entry can be
deleted. The modifications to be made can be specified on a command
line or in an LDIF file. An LDIF file is recommended for specifying
modifications since a large number of modifications can be specified in
an LDIF file. As an example add a new entry specified in addEntry.ldif
in Listing 2.
Listing 2 addEntry.ldif
dn: cn=Deepak Vohra,ou=jdeveloper,dc=example,dc=com
objectclass: top
objectclass: person
objectclass: organizationalPerson
cn: Deepak Vohra
sn: Vohra
title: JDeveloper Developer
The -a option of the ldapmodify command is used to add a new entry. Run the ldapmodify command as shown below. The LDIF file is specified with the -f option.
ldapmodify -D "cn=Manager,dc=example,dc=com" -w openldap -a -f addEntry.ldif
A new directory entry gets added. A directory entry can also be modified. For example, modify the title in the previously added entry. The directory modifications are specified in an LDIF file as shown in Listing 3.
Listing 3. modifyEntry.ldif
dn: cn=Deepak Vohra,ou=jdeveloper,dc=example,dc=com
changetype: modify
replace: title
title: Oracle DBA
Run the ldapmodify command as shown below.
ldapmodify -D "cn=Manager,dc=example,dc=com" -w openldap -a -f modifyEntry.ldif
The directory entry gets modified.
Next, delete a directory entry. As an example, delete the entry that was added with ldapmodify. Specify the DN of the entry to delete an LDIF file as shown in Listing 4. The delete operation is specified with changetype:delete.
Listing 4 deleteEntry.ldif
dn: cn=Deepak Vohra,ou=jdeveloper,dc=example,dc=com
changetype: delete
Run the ldapmodify command as shown below:
ldapmodify -D "cn=Manager,dc=example,dc=com" -w openldap -f deleteEntry.ldif
The directory entry gets deleted.
Deleting a Directory
The ldapdelete tool is used
to delete directory entries. The DNs for the entries to delete can be
specified on the command line or in an LDIF file. As an example delete
the directory entry for DN "ou=jdevloper,dc=example,dc=com." To delete
recursively specify the -r option. The ldapdelete command to delete a
directory entry by authenticating to the directory is shown below:
>ldapdelete -D "cn=Manager,dc=example,dc=com" -r -v -w openldap "ou=jdeveloper,dc=example,dc=com"
Non-leaf entries don't get deleted with the ldapdelete tool.
Conclusion
The OpenLDAP LDAP server provides a
directory service to store and modify information about network
resources in a directory that's stored in the Berkeley DB.