LDAP is an internet protocol for accessing and updating information organized in directories. Here, a directory is a listing of information about objects arranged in some order that gives details about each object. Such directories are managed by directory servers and can be accessed using the Lightweight Directory Access Protocol. For example,
would be an URI to access information from the object with an attribute cn and the value “Test
User”, located somewhere in the sub tree below an object with attribute/value ou=people that is below an object with attribute/value o=alkacon.com.
Compared to a usual file system, note the following aspects:
- The data is organized hierarchically, but there is no difference between files and folders; all nodes are objects containing attributes and (multiple) values according to object specifications called schemas.
- The “path” to the object is build from right-to-left; this means the root node is the rightmost part. So, in ou=people,o=alkacon.com the node with o=alkacon.com is the root of the object hierarchy.
- In order to obtain an overview of conceptual and technical aspects of LDAP, see the following
- LDAP Wikipedia entry - https://en.wikipedia.org/wiki/Lightweight_Directory_Access_Protocol
- The JNDI Tutorial - https://docs.oracle.com/javase/tutorial/jndi/index.html
- OpenLDAP, open source LDAP implementation - http://www.openldap.org
Besides any LDAP entities used to build a hierarchical structure within the LDAP server, the OpenCms LDAP driver expects data objects to specify a single user and to specify a single group, including the membership information. Typically, these objects are based on standard LDAP object classes, where the exact data mapping can be modified by changing the configuration options for data mapping.
Since the starting points for user and group lookups can be specified in the configuration options, the OpenCms LDAP driver does not expect any specific organization of the LDAP entities. Especially, for both user and group lookups, more than one starting point can be specified. As an example, here is an outline of the hierarchical organization of the LDAP example data. The user and group entities are separated into various structures: users and groups needed by OpenCms are located below
ou=OpenCms,ou=Applications,dc=my-domain,dc=com and non-system users
and groups are located below
ou=People,dc=my-domain,dc=com and ou=Groups,dc=my-domain,dc=com