The LDAP directory
The directory versus the database, the tree and its entries, distinguished and relative names, object classes and attributes, the LDIF format, operations, and search by base, scope and filter.
- 26 cards
- 4 topics
- Free
The outline, topic by topic
Each topic is weighted the way the exam weighs it.
- Concepts
- Questions
- Sort and link
- Scenarios
A few cards from the deck
Directory: what is it?
Show the answer
A hierarchical store, optimised for reading, that lists an organisation's people, groups and machines.
Many reads, few writes, a standard protocol: every service asks it who is who. It is not a transactional database.
Base ou=people, scope one, filter (&(objectClass=person)(!(l=Lyon))). Which entries are returned?
```text
ou=people
uid=lea objectClass: person l: Lyon
uid=tom objectClass: person l: Paris
uid=ines objectClass: person l: Lyon
uid=omar objectClass: person l: Paris
uid=nina objectClass: person`- tom, omar and nina
- tom and omar
- lea and ines
- tom, omar, nina and ou=people
Show the answer
tom, omar and nina
(!(l=Lyon)) is true for every entry whose l is not Lyon, including the one with no l attribute: nina is returned. The one scope excludes the base ou=people itself.
To change Léa's address with ldapmodify, the LDIF carries the entry's dn: line, then changetype: modify, then …: mail followed by the new value.
Show the answer
To change Léa's address with ldapmodify, the LDIF carries the entry's dn: line, then changetype: modify, then replace: mail followed by the new value.
In a modification, replace replaces all the attribute's values, add adds values and delete removes one or all of them. changetype announces the operation: add, modify or delete.
LDAP: what is it?
Show the answer
The standard protocol to query and modify a directory, in clear on port 389, or encrypted through StartTLS or on port 636.
A simple bind on port 389 without encryption sends the password in clear: StartTLS or LDAPS is required.
ldapadd answers "Object class violation (65) – object class 'inetOrgPerson' requires attribute 'sn'". Probable cause and fix?
- The binding account may not write: change account
- The entry lacks the mandatory sn attribute: add it to the LDIF
- The entry's parent does not exist: create the organisational unit first
- An entry with the same name already exists: delete it before adding
Show the answer
The entry lacks the mandatory sn attribute: add it to the LDIF
The object class sets the mandatory attributes; here sn is missing. The other causes have other codes: Insufficient access (50), No such object (32), Already exists (68).