What Is LDAP?

(An excerpt from Understanding and Deploying LDAP Directory Services)

At its core, LDAP is a standard, extensible directory access protocol—a common language that LDAP clients and servers use to communicate with each other. Standardization of the protocol has the benefit that client and server software from different vendors can interoperate. When you buy an LDAP-enabled program, you can expect that it will work with any standards-compatible LDAP server. This has many advantages.

LDAP is a “lightweight” protocol, which means that it is efficient, straight-forward, and easy to implement, while still being highly functional. Contrast this with a “heavyweight” protocol, such as the X.500 Directory Access Protocol (DAP). X.500 DAP uses complex encoding methods and requires use of the OSI network protocol stack—a networking system that has failed to gain wide acceptance.

LDAP, on the other hand, uses a simplified set of encoding methods and runs directly on top of TCP/IP. Every major desktop and server computing platform currently available (Microsoft Windows, DOS, UNIX, and the Apple Macintosh) either ships with a TCP/IP implementation or can be easily equipped with one. OSI networking, on the other hand, is not universally available, and it is almost always an extra-cost option. LDAP, by virtue of its light weight, removes significant barriers to implementation and deployment.

There have been two major revisions of the LDAP protocol. The first widely available version was LDAP version 2, defined in RFCs 1777 and 1778. As of this writing, LDAP version 3 is a Proposed Internet Standard, defined in RFCs 2251 through 2256. Because it is so new, not all vendors completely support LDAPv3 yet. As we discuss LDAP, we will focus our discussion on LDAPv3. However, we will point out new features found only in LDAPv3 so that you can understand the limitations you will encounter if you are using LDAPv2.

In addition to its role as a network protocol, the LDAP standards also define four models that guide you in your use of the directory. These models promote interoperability between directory installations while still allowing you the flexibility to tailor the directory to your specific needs. The models borrow con-cepts from X.500, but they generally lack many of the restrictions that the X.500 models include. The four LDAP models are as follows:

• The LDAP information model, which defines the kind of data you can put into the directory.
• The LDAP naming model, which defines how you organize and refer to your directory data. • The LDAP functional model, which defines how you access and update the information in your directory.
• The LDAP security model, which defines how information in the directory can be protected from unauthorized access.

In addition to guiding you in the use of your directory, the LDAP models guide directory developers when designing and implementing LDAP server and client software.

There are several LDAP APIs, the oldest of which is for the C programming language. The C API is supported by several freely available software development kits (SDKs), including one available in binary and source code format from Netscape Communications Corporation. In addition to the C API, Netscape’s freely available Java SDK (also available in binary and source code formats) supports all LDAPv3 features. Netscape also provides PerLDAP, a toolkit for the Perl language that allows you to access LDAP directories.

SunSoft’s JNDI is a proprietary, unified directory access API that supports access to multiple types of directory services (NIS+, LDAP, and others). Microsoft offers its own proprietary unified directory access API, known as Active Directory Services Interface (ADSI).

LDAP also defines the LDAP Data Interchange Format (LDIF), a common, text-based format for describing directory information. LDIF can describe a set of directory entries or a set of updates to be applied to a directory. Directory data can also be exported from one directory and into another using LDIF. Most of the commonly available command-line utilities also read and write LDIF.

Click here for more information on ordering this book or click here to continue reading on this subject.

Papers:

Understanding LDAP	(IBM)
Directory Based Extranets	(Giga Information Group)
The Enterprise Directory Value Proposition	(The Burton Group)
Global Directory Server Data Sheet	(Critical Path)
Directory Evaluation Guide	(iPlanet)
An Internet Approach to Directories	(iPlanet)
A System Administrator's View of LDAP	(iPlanet)
The LDAP Heavyweight - Protecting Data Over the Wire	(iPlanet)
The LDAP Heavyweight - Straight Talk About Security for System Administrators	(iPlanet)
INNOVATORS OF THE NET: TIM HOWES AND LDAP

Vendors:

Directory Vendors
	Critical Path
	IBM SecureWay
	Innosoft
	iPlanet Directory Server
	Microsoft Active Directory
	Novell NDS eDirectory
	OpenLDAP
	Oracle Internet Directory
Meta-Directory Vendors
	iPlanet Meta-Directory
	MaXware Enterprise Meta Solution
	Microsoft Metadirectory Services
	Novell NDS DirXML
	Siemens DirX Meta Directory
	Syntegra Meta Edition
Virtual Directory Vendors
	Crossworlds
	Data Junction
	Informatica
	Radiant Logic
Directory Based Solutions Vendors
	Netegrity
	Oblix

Organizational Bodies (Get Involved):

The Open Group Directory Program
IETF's ldapext working group
LDAP Replication Working Group

Case Studies:

Texas Instruments	(Critical Path)
Eircom (formerly Telecom Eireann)	(Critical Path)
Movenpick Group	(Critical Path)
Canton Aargau	(Critical Path)
Smithkline Beecham	(Critical Path)
Pacific Bell	(Critical Path)
Education Department of Western Australia	(Critical Path)
Numerous Case Studies from Novell	(Novell)
Numerous Case Studies from iPlanet	(iPlanet)

Useful RFCs:

Useful Resources:

Other useful books from Amazon.com: