https://lesitedefrancois.be/en/tags/directory/Recent content in Directory on Le Site de FrançoisHugo -- gohugo.ioen© 2026 Françoishttps://lesitedefrancois.be/en/security/ldap/Mon, 01 Jan 0001 00:00:00 +0000https://lesitedefrancois.be/en/security/ldap/<p><strong>LDAP (Lightweight Directory Access Protocol)</strong> is a client-server protocol for accessing and modifying a <strong>directory service</strong>: a specialised database optimised for read-heavy, hierarchically-organised identity data. It was derived from the X.500 directory standard in the early 1990s, stripping out OSI transport dependencies to run over TCP/IP, and standardised in its current form in RFC 4511 (LDAPv3, 2006). A directory in the LDAP sense is not a general-purpose database — it is a tree of <strong>entries</strong> (also called objects), each identified by a <strong>Distinguished Name (DN)</strong> that encodes its position in the hierarchy: <code>cn=alice,ou=users,dc=example,dc=com</code>. Each entry is an instance of one or more <strong>object classes</strong> (defined in a <strong>schema</strong>), and each object class defines a set of mandatory and optional <strong>attributes</strong> — typed, multi-valued fields such as <code>uid</code>, <code>cn</code> (common name), <code>mail</code>, <code>userPassword</code>, <code>memberOf</code>, <code>sshPublicKey</code>, <code>objectClass</code>, and <code>userCertificate</code>. The schema is extensible: LDAP servers ship with standard schema files (RFC 2307 for POSIX users and groups, RFC 4519 for person entries) and organisations add custom schema for application-specific attributes. The tree structure makes hierarchical policy delegation natural — all objects under <code>ou=engineering,dc=example,dc=com</code> can be administered by a different set of ACL rules than objects under <code>ou=ops</code>.</p>