Lightweight Directory Access Protocol

Lightweight Directory Access Protocol (LDAP) is a protocol for accessing on-line directory services.

The IETF designed and specified LDAP as a better way to make use of X.500 directories - having found the original Directory Access Protocol (DAP) too complex for simple internet clients to use. LDAP defines a relatively simple protocol for updating and searching directories running over TCP/IP.

The common term "LDAP directory" can mislead. No specific type of directory is an "LDAP directory". One could reasonably use the term to describe any directory accessible using the LDAP protocol and which can identify objects in the directory with X.500 identifiers. Directories such as OpenLDAP and its predecessors from the University of Michigan, though primarily designed as native repositories optimized for access by LDAP rather than as a gateway to X.500 protocols as was provided in ISODE, are nevertheless no more "LDAP directories" than any other directory accessible by the LDAP protocol.

The protocol was authored by Tim Howes of Netscape, Steve Kille of ISODE and Mark Wahl of Critical Angle Inc.

LDAP has gained wide support from vendors such as:

• Apache (through Apache Directory Server)
• Apple (through Open Directory)
• AT&T
• Banyan
• HP
• IBM/Lotus
• ISODE (through M-Vault server)
• Microsoft (through Active Directory)
• Netscape (now in Sun Microsystems and Red Hat products)
• Novell (through eDirectory)
• OctetString (through VDE server)
• Oracle (through Oracle Internet Directory)
• Red Hat (through Fedora Directory Server (http://directory.fedora.redhat.com/))
• SiemensAG (through DirX server)
• SGI and
• Sun (through iPlanet directory server)

as well as in open source/free software implementations such as OpenLDAP. Also the Apache_HTTP_Server used as a proxy (by the module mod_proxy) supports LDAP.

An LDAP directory entry consists of a collection of attributes and is referenced unambiguously with a name, called a distinguished name (DN). For example, a DN might be the value "cn=John Doe,ou=people,dc=wikipedia,dc=org". Each of the entry's attributes are defined as part of an object class and are grouped together into schemas; those schemas for representing individual people within organizations are termed white pages schema. Each entry in the database is associated with one or more these object classes, which define whether an attribute is optional or mandatory, and what type of information it stores. The attribute names are typically mnemonic strings, like "cn" for common name, or "mail" for e-mail address. The values depend on the type, and most non-binary values in LDAPv3 use UTF-8 string syntax. For example, a mail attribute might contain the value "user@example.com". A jpegPhoto attribute would contain a photograph in binary JPEG/JFIF format.

LDAP directory entries feature a hierarchical structure that reflects political, geographic, and/or organizational boundaries. In the original X.500 model, entries representing countries appear at the top of the tree; below them come entries representing states or national organizations. Typical LDAP deployments use DNS names for structuring the top levels of the hierarchy. Further below might appear entries representing people, organizational units, printers, documents, or just about anything else.

LDAP has influenced subsequent Internet protocols, including later versions of X.500, Directory Services Markup Language (DSML), Service Provisioning Markup Language (SPML) and the Service Location Protocol.

RFCs

• RFC 1777 - LDAPv2
• RFC 1778 - LDAPv2 String Representation of Standard Attribute Syntaxes
• RFC 1959 - URL Format
• RFC 1960 - RFC 2254 String Representation of LDAP Search Filters
• RFC 1823 - C API
• RFC 2247 - Use of DNS domains in distinguished names
• RFC 2251 - LDAPv3: The specification of the LDAP on-the-wire protocol
• RFC 2252 - LDAPv3: Attribute Syntax Definitions
• RFC 2253 - LDAPv3: UTF-8 String Representation of Distinguished Names
• RFC 2254 - LDAPv3: The String Representation of LDAP Search Filters
• RFC 2255 - LDAPv3: The LDAP URL Format
• RFC 2256 - LDAPv3: A Summary of the X.500(96) User Schema for use with LDAPv3
• RFC 2829 - LDAPv3: Authentication Methods for LDAP
• RFC 2830 - LDAPv3: Extension for Transport Layer Security
• RFC 3377 - LDAPv3: Technical Specification
• RFC 2307 - Using LDAP as a Network Information Service

References

External links

• Software
  • OpenLDAP (http://www.openldap.org)
  • Novell eDirectory (http://www.novell.com/products/edirectory/)
  • Sun Directory Server (http://www.sun.com/software/products/directory_srvr/home_directory.xml)
  • Windows Server 2003 Active Directory (http://www.microsoft.com/windowsserver2003/technologies/directory/activedirectory/default.mspx)
  • EDS Admin tool (http://edsadmin.sourceforge.net/)
  • Freeware Win32 LDAP Client (http://www.softerra.com/products/ldapbrowser.php)
• Linux LDAP HOWTO (http://www.tldp.org/HOWTO/LDAP-HOWTO/)
• LDAP Articles, Links, Whitepapers (http://www.bind9.net/ldap/)
• LDAP Software, Tools & Utilities (http://www.bind9.net/ldap-tools)
• LDAP (v3) Revision (ldapbis) Working Group (http://www.ietf.org/html.charters/ldapbis-charter.html)
• What is LDAP? (http://www.gracion.com/server/whatldap.html)
• Nice Neat Introduction To LDAP with examples  (http://twistedmatrix.com/users/tv/ldap-intro/ldap-intro.html)
• Using OpenLDAP - Installing OpenLDAP under Debian GNU/Linux (http://www.metaconsultancy.com/whitepapers/ldap.htm)
• LDAP Authentication for Linux - Integrating LDAP into PAM (http://www.metaconsultancy.com/whitepapers/ldap-linux.htm)
• LDAP Libraries for C# (http://forge.novell.com/modules/xfmod/project/showfiles.php?group_id=1318).
• LDAP for Rocket Scientists (http://www.zytrax.com/books/ldap/)
• LDAP implemention for PerLDAP 1.4 (http://www.perldap.org)
• The importance of LDAP (http://www.freesoftwaremagazine.com/free_issues/issue_03/ldap/) A commentary by Tom Jackiewicz about LDAPbg:LDAP

de:Lightweight Directory Access Protocol fr:Lightweight Directory Access Protocol nl:Lightweight Directory Access Protocol ja:Lightweight Directory Access Protocol pl:Lightweight Directory Access Protocol pt:Lightweight Directory Access Protocol ru:LDAP