Chapter 9. LDAP Functional Model

This section describes the 'wire' protocol that LDAP clients and servers use when communicating.

If you need to know this stuff carry on, but the really smart thing to do is use the excellent Open Source wireshark (ex-ethereal) to do all the disassembly for you - if wireshark does not support a protocol we have not yet come across it. Wonderful software.

Finally LDAP uses the ITU's BER (Basic Encoding Rules) to save three bytes on each transfer. You will need (and pay handsomely for it) X.690 with defines BER.

Alternatively you can download Prof. John Larmouth's ASN.1 Complete (its free but you must register to get it) or you can purchase a copy from Morgan Kaufmann Publishers (ISBN: 0-12-233435-3). In no way second best is Olivier Dubuisson's ASN.1 - Communication between heterogeneous systems (free but you have to register) another world renowned ASN.1 expert. Again you can purchase his book from Morgan Kaufmann Publishers (ISBN: 0-12-6333361-0). This site has excellent ASN.1 and BER resources.

9. LDAP Functional Model Contents

9.1 Functional Model Overview
9.2 Generic Format
9.3 Primitives (Operations)
9.4 LDAP URL

One day real soon now ™

One day real soon now ™

One day real soon now ™

The LDAP URL is a useful feature - but a bit of a con. The LDAP URL (RFC 4510 and RFC 4516) defines a method by which you can enter something that looks like a URL into some version 5 browsers (MSIE 5.5+ and any Gecko browser supports ldap, Opera 7.x beta and Konqueror do not) and it will perform a LDAP read-only query on the host using the parameters defined in the URL. Both MSIE and Gecko allow you to add any found entries to an address book (and look to have a common code base).

The con bit (we're being very unfair here) is that the browser translates this request into a standard LDAP search/query primitive. The URL'ish notation is just a (useful) browser interface.

LDAP URL Format

The formal syntax is:

scheme "://" [host:port] ["/"[dn ["?" [attributes] ["?" [scope] ["?" [filter]
                ["?" extensions]]]]]]

Where:

Example LDAP URLs

Connect using anonymous access to host.example.com using port 389 with a DN of ou=people,dc=example.com, return all available attributes for entries, go down one level on the search and return all found entries.

ldap://host.example.com/ou=people,dc=example,dc=com??one?(objectclass=*)

Connect using anonymous access to host.example.com using port 9000 with a DN of ou=people,dc=example.com, return all available attributes for entries, go down one level on the search and return all entries

ldap://host.example.com:9000/ou=people,dc=example,dc=com??one?(objectclass=*)

Connect using anonymous access to a host of the browsers choosing (we can't figure how to configure this one) using port 389 with a DN of ou=people,dc=example.com, return all attributes available for entries, go down one level on the search and return all entries with s or S anywhere in the common name:

ldap:///ou=people,dc=example,dc=com??one?(cn=*s*)

Connect using anonymous access to host.exmple.com using port 389 with a DN of ou=people,dc=example.com, return mail attributes only, go down one level on the search and return all entries which have one or more mail attributes:

ldap://host.example.com/ou=people,dc=example,dc=com?mail?one?(mail=*)

Connect using anonymous access to host.example.com using port 389 with a DN of ou=people,dc=example.com, return all attributes available for entries, seach whole subtree below base DN and return all entries with sn starting with a or A.

ldap://host.example.com/ou=people,dc=example,dc=com???(sn=a*)