A directory service is an application(s) that stores, retrieves, and modifies information about network resources such as network users. The actual data is stored in a database; a database service is an abstract layer on top of the database. The Lightweight Directory Access Protocol (LDAP) is a lightweight protocol for accessing directory services. LDAP is based on entries; an entry is a set of attributes identified by a globally unique Distinguished Name (DN). Each of a directory entry's attributes has a type and one or more values. The attributes in a directory entry's distinguished name(DN) are arranged in a hierarchy from right to left with the rightmost attribute as the top entry and with the leftmost attribute(s) that are unique to its level called a Relative Distinguished Name (RDN). A DN is a sequence of RDNs. Some examples of attribute types are discussed in Table 1.
An entry in a directory is identified by a distinguished name (DN). An example of a directory entry's distinguished name is:
cn=dvohra,ou=People,dc=example,dc=com
In the example DN, the base entry/root is "dc=example,dc=com." The relative distinguished name is "cn=dvohra." LDAP defines operations for adding, searching, modifying, and deleting directory entries. An LDAP server is required to provide a LDAP directory service. OpenLDAP is an open source software package that includes a LDAP directory server (slapd). OpenLDAP is built on top of the Berkeley DB, an embedded database. In this article we'll create a directory service using the OpenLDAP directory server.
Installing OpenLDAP
Download OpenLDAP for Windows. Double-click on the OpenLDAP application openldap-2.2.29-db-4.3.29-openssl-0.9.8a-BDB_ONLY-win32_Setup.exe. The OpenLDAP setup wizard gets started as shown in Figure 1. Click on the Next button.
Accept the license agreement and click on the Next button. Select the default destination, C:\Program Files\OpenLDAP and click on the Next button. Select components BDB-tools and OpenLDAP-slapd as NT service and click on Next as shown in Figure 2.
Specify a Start Menu folder and click on Next. Select additional tasks such as "automatically start OpenLDAP NT service after reboot" and "Create a desktop item" and click on Next. Click on the Install button to install OpenLDAP as shown in Figure 3.
Configuring OpenLDAP
The configuration for a slapd server is specified in the slapd.conf configuration file. Configuration information comes in three types: global, back-end and database. The configuration information is specified with directives; the global directives precede the back-end directives that precede the database directives.
The global directives apply to all back-ends and database types. Some of the commonly used global directives are discussed in Table 2
Back-end directives specify a back-end and apply to all database instances in a back-end. The commonly used back-end directive is as follows:
backend <type>
The back-end directive specifies a back-end declaration. Some of the back-end types are bdb (Berkeley DB transactional back-end) and sql (SQL programmable back-end).
Database directives specify information about a database instance. Some of the commonly used database directives are discussed in Table 3.
Next, we'll modify the directives in the slapd.conf file in the C:\Program Files\OpenLDAP directory of the OpenLDAP server we installed earlier. The database directive is already set to bdb for the Berkeley DB database. Set the suffix, rootdn, and rootpw as shown in following listing:
database bdb
suffix "dc=example,dc=com"
rootdn "cn=Manager,dc=example,dc=com"
rootpw openldap
directory ./data
Creating a Directory
Next, we'll create a directory in the OpenLDAP LDAP server. For example, create a directory of JDeveloper developers. LDAP entries are represented in the LDAP Data Interchange Format (LDIF) in an .ldif format. The format of an entry in n LDIF file is as follows:
#comment
dn: <distinguished name>
<attrdesc>: <attrvalue>
<attrdesc>: <attrvalue>
Create a jdevDir.ldif file for a directory of JDeveloper developers. A root/base DN was specified in the slapd.conf file with the suffix directive:
suffix "dc=example,dc=com"
In the .ldif file add an entry for the base DN. Each directory entry is identified with a dn attribute. The objectClass attributes specify the type of data, and required and optional attributes in an entry. Object classes form a class hierarchy and some of the commonly used object classes are top, organization, and organizationalPerson. The object classes that may be specified in a directory entry and the attributes that may be specified or have to be specified for an object class are listed in the C:\Program Files\OpenLDAP\schema\core.schema file:
dn: dc=example,dc=com
objectClass: top
objectClass: dcObject
objectClass: organization
dc :example
o: Oracle
Next, add an entry for an organizational unit called jdeveloper under dc=example, dc=com. Directory entries in an LDIF file are separated with a blank line.
dn: ou=jdeveloper, dc=example, dc=com
objectClass: organizationalUnit
ou: jdeveloper
