Professional Documents
Culture Documents
Amrish Kaushik
Graduate Student USC Computer Science (CN)
Agenda
Protocol Model Mapping onto Transport Services Protocol Element Encoding Discussion
Functionality Ease-of-Use Administration (Application specific dirs) Clear and consistent organization Integrity Confidentiality
X.500
X.500
Organizes directory entries into a hierarchical namespace Powerful search capabilities Often used for interfacing incompatible directory services Used DAP for c/s communication DAP (App. Layer) requires ENTIRE OSI stack to operate Too heavy for small environments
What is LDAP?
Lightweight Directory Access Protocol Used to access and update information in a directory built on the X.500 model Specification defines the content of messages between the client and the server Includes operations to establish and disconnect a session from the server
Understanding LDAP
Lightweight alternative to DAP Uses TCP/IP instead of OSI stack Simplifies certain functions and omits others Uses strings rather than DAPs ASN.1 notation to represent data.
LDAP
Information
Structure of information stored in an LDAP directory. How information is organized and identified. Describes what operations can be performed on the information stored in an LDAP directory. Describes how the information can be protected from unauthorized access.
Naming
Functional / Operations
Security
Each attribute has a type/syntax and a value Can define how values behave during searches/directory operations Syntax: bin, ces, cis, tel, dn etc. Usage limits: ssn only one, jpegPhoto 10K
Person, Server, Printer etc. InetOrgPerson(cn, sn, ObjectClass) cn (cis), sn (cis), telephoneNumber (tel), ou (cis), owner (dn), jpegPhoto (bin)
Example Entry:
Example Attributes:
LDAP Naming
Directory Information Tree (DIT) Follow geographical or organizational scheme Aliases: Tree-like, Aliases can link non-leaf nodes
LDAP Naming
Implementation differs
LDAP Naming
Schema
Defines what object classes allowed Where they are stored What attributes they have (objectClass) Which attributes are optional (objectClass) Type/syntax of each attribute (objectClass)
Query server for info: zero-length DN LDAP schema must be readable by the client
LDAP Functions/Operations
Authentication
BIND/UNBIND ABANDON Search Compare entry Add an entry Delete an entry (Only Leaf nodes, no aliases) Modify an entry, Modify DN/RDN
Query
Update
User-id/password based authentication Anonymous connection - default access rights Encryption/Kerberos also supported
Client ends the session (UNBIND) Client can ABANDON the session
BIND/UNBIND/ABANDON
Request includes LDAP version, the name the client wants to bind as, authentication type
Simple (clear text passwords, anonymous) Kerberos v4 to the LDAP server (krbv42LDAP) Kerberos v4 to the DSA server (krbv42DSA)
ABANDON:
Search/Compare
Request includes
baseObject: an LDAPDN Scope: how many levels to be searched derefAliases: handling of aliases sizeLimit: max number of entries returned timeLimit: max time allowed for search attrsOnly: return attribute types OR values also Filter: cond. to be fulfilled when searching Attributes: List of entrys attributes to be returned
Read and List implemented as searches Compare: similar to search but returns T/F
ADD/MODIFY/DELETE
ADD request
Entry: LDAPDN List of Attributes and values (or sets of values) Used to add, delete, modify attributes Request includes
MODIFY request
DELETE request
Object: LDAPDN
Protocol Elements
Protocol Elements
LDAPString ::= OCTET STRING LDAPDN ::= LDAPString RelativeLDAPDN ::= LDAPString AttributeValueAssertion ::=
Sequence { attributeType attributeValue, attributeValue attributeValue }
Protocol Elements
LDAP Security
Other authentication methods possible in future versions (March 1995) SASL support added in version 3
LDAP Security
Security based on the BIND model Clear text ver 1 Kerberos ver 1,2,3 (depr) SASL ver 3
Simple Authentication and Security Layer uses one of many authentication methods Based on SSL v3 from Netscape
LDAP Security
DN and password provided Clear-text or Base 64 encoded Parameters: DN, mechanism, credentials Provides cross protocol authentication calls Encryption can be optionally negotiated ldap_sasl_bind() (ver3 call) Ldap://<ldap_server>/?supportedsaslmechanisms
LDAP Security
LDAP Security
SSL/TLS Handshake
Agenda
Protocol Model Mapping onto Transport Services Protocol Element Encoding Discussion
Protocol Model
Client sends protocol request to server Server performs operation on directory Server returns response (results/errors)
LDAPMessage PDU mapped onto TCP byte stream LDAP listener on port 389
Encoded for Exchange using BER (Basic Encoding Rules) BER defined in Abstract Syntax Notation One (ASN.1) High Overhead for BER
Definite form of length encoding only Bit Strings/ Octet Strings and all character string types encoded in primitive form only
LDAP Implementations
C Library API
LDAPv2 - RFC 1823 The LDAP API LDAPv3 In Internet Draft stage
Java JNDI LDAP v3 uses the UTF-8 encoding of the Unicode character set. HTTP to LDAP gateway LDAP to X.500 gateway ldapd
Referrals
A server that does not store the requested data can refer the client to another server. Extensible authentication using Simple Authentication and Security Layer (SASL) UTF-8 support for international characters. New object types and operations can be dynamically defined and schema published in a
Security
Internationalization
Extensibility