LDAP, the Lightweight Directory Access Protocol, lets a client read and change entries in a directory service. A directory holds attribute-based records in a hierarchy. It is commonly used for identity data, address books, device inventories, application configuration, and other information that is searched more often than it is changed.

LDAP is a protocol, not a particular database or identity product. OpenLDAP, 389 Directory Server, ApacheDS, Microsoft Active Directory Domain Services, and commercial directory servers expose LDAP while making different choices about storage, replication, administration, and extensions. An application can also use LDAP only as an integration interface to a larger identity system.

The directory information tree

LDAP organizes entries into a directory information tree, or DIT. Each entry has a distinguished name, or DN, that identifies its position. This example names a person below an organizational unit and a domain:

uid=maya,ou=people,dc=example,dc=com

The leftmost component is the relative distinguished name, or RDN, of the entry. The remaining components name its ancestors. DNs are identifiers and paths through the namespace; they are not ordinary display strings. Special characters must be escaped according to the DN string rules.

An entry contains attributes. Each attribute has a type and one or more values. A person entry might contain uid, cn, sn, and mail. Operational attributes hold server-managed information such as timestamps or entry identifiers. Clients usually receive user attributes by default and request operational attributes explicitly.

Schema gives those attributes meaning. Attribute types define syntax and matching behavior. Object classes state which attributes an entry must or may contain. A structural object class describes the main kind of entry, while auxiliary object classes add characteristics. Schema validation prevents a directory from becoming an arbitrary collection of incompatible records.

The directory information tree

Relevant careers