2 # Copyright 1999, The OpenLDAP Foundation, All Rights Reserved.
3 # COPYING RESTRICTIONS APPLY, see COPYRIGHT.
4 H1: Introduction to slapd and slurpd
6 This document describes how to build, configure, and run the stand-alone
7 LDAP daemon ({{I:slapd}}) and the stand-alone LDAP update replication
8 daemon ({{I:slurpd}}). It is intended for newcomers and experienced
9 administrators alike. This section provides a basic introduction to directory
10 service, and the directory service provided by {{I:slapd}} in particular.
14 H2: What is a directory service?
16 A directory is like a database, but tends to contain more descriptive,
17 attribute-based information. The information in a directory is generally read
18 much more often than it is written. As a consequence, directories don't
19 usually implement the complicated transaction or roll-back schemes regular
20 databases use for doing high-volume complex updates. Directory updates
21 are typically simple all-or-nothing changes, if they are allowed at all.
22 Directories are tuned to give quick-response to high-volume lookup or
23 search operations. They may have the ability to replicate information widely in
24 order to increase availability and reliability, while reducing response time.
25 When directory information is replicated, temporary inconsistencies between
26 the replicas may be OK, as long as they get in sync eventually.
28 There are many different ways to provide a directory service. Different
29 methods allow different kinds of information to be stored in the directory,
30 place different requirements on how that information can be referenced,
31 queried and updated, how it is protected from unauthorized access, etc.
32 Some directory services are {{I:local}}, providing service to a restricted
33 context (e.g., the finger service on a single machine). Other services are
34 global, providing service to a much broader context (e.g., the entire Internet).
35 Global services are usually {{I:distributed}},
36 meaning that the data they contain
37 is spread across many machines, all of which cooperate to provide the
38 directory service. Typically a global service defines a uniform {{I:namespace}}
39 which gives the same view of the data no matter where you are in relation to
46 {{I:Slapd}}'s model for directory service is based on a global directory model
47 called LDAP, which stands for the Lightweight Directory Access Protocol.
48 LDAP is a directory service protocol that runs over TCP/IP. The nitty-gritty
49 details of LDAP are defined in RFC 1777 "The Lightweight Directory Access
50 Protocol." This section gives an overview of LDAP from a user's perspective.
52 {{I:What kind of information can be stored in the directory?}}
54 service model is based on {{I:entries}}. An entry is a collection of
55 attributes that has a name, called a {{I:distinguished name}} (DN).
56 The DN is used to refer to the entry unambiguously. Each of the
57 entry's attributes has a {{I:type}} and one or
59 The types are typically mnemonic strings, like "{{EX:cn}}" for common
60 name, or "{{EX:mail}}" for email address. The values depend on what type of
61 attribute it is. For example, a {{EX:mail}} attribute might contain the value
62 "{{EX:babs@openldap.org}}". A {{EX:jpegPhoto}} attribute would contain
63 a photograph in binary JPEG/JFIF format.
65 {{I:How is the information arranged?}}
66 In LDAP, directory entries are arranged in
67 a hierarchical tree-like structure that reflects political, geographic and/or
68 organizational boundaries. Entries representing countries appear at the top
69 of the tree. Below them are entries representing states or national
70 organizations. Below them might be entries representing people,
71 organizational units, printers, documents, or just about anything else you can
72 think of. Figure 1 shows an example LDAP directory tree, which should help
76 !import "intro_tree.gif"; align="center"; title="An example LDAP directory tree"
77 FT[align="Center"] Figure 1: An example LDAP directory tree.
80 In addition, LDAP allows you to control which attributes are required and
81 allowed in an entry through the use of a special attribute called
83 The values of the {{I:objectclass}} attribute determine
84 the {{I:schema}} rules the entry
87 {{I:How is the information referenced?}}
88 An entry is referenced by its
89 distinguished name, which is constructed by taking the name of the entry
90 itself (called the relative distinguished name, or RDN) and concatenating the
91 names of its ancestor entries. For example, the entry for Barbara Jensen in
92 the example above has an RDN of "{{EX:cn=Barbara J Jensen}}" and a DN of
93 "{{EX:cn=Barbara J Jensen, o=OpenLDAP Project, c=US}}". The full DN format is
94 described in RFC 1779, "A String Representation of Distinguished Names."
96 {{I:How is the information accessed?}}
97 LDAP defines operations for interrogating
98 and updating the directory. Operations are provided for adding and deleting
99 an entry from the directory, changing an existing entry, and changing the
100 name of an entry. Most of the time, though, LDAP is used to search for
101 information in the directory. The LDAP search operation allows some portion
102 of the directory to be searched for entries that match some criteria specified
103 by a search filter. Information can be requested from each entry that matches
106 For example, you might want to search the entire directory subtree below the
107 OpenLDAP Project for people with the name Barbara Jensen, retrieving
108 the email address of each entry found. LDAP lets you do this easily. Or you
109 might want to search the entries directly below the c=US entry for
110 organizations with the string "Acme" in their name, and that have a fax
111 number. LDAP lets you do this too. The next section describes in more detail
112 what you can do with LDAP and how it might be useful to you.
114 {{I:How is the information protected from unauthorized access?}}
116 services provide no protection, allowing anyone to see the information. LDAP
117 provides a method for a client to authenticate, or prove its identity to a
118 directory server, paving the way for rich access control to protect the
119 information the server contains.
123 H2: How does LDAP work?
125 LDAP directory service is based on a {{I:client-server}} model. One or more
126 LDAP servers contain the data making up the LDAP directory tree. An LDAP
127 client connects to an LDAP server and asks it a question. The server
128 responds with the answer, or with a pointer to where the client can get more
129 information (typically, another LDAP server). No matter which LDAP server a
130 client connects to, it sees the same view of the directory; a name presented
131 to one LDAP server references the same entry it would at another LDAP
132 server. This is an important feature of a global directory service, like LDAP.
137 H2: What is slapd and what can it do?
139 {{I:Slapd}} is an LDAP directory server that runs on many different UNIX
140 platforms. You can use it to provide a directory service of your very own.
141 Your directory can contain pretty much anything you want to put in it. You
142 can connect it to the global LDAP directory service, or run a service all by
143 yourself. Some of slapd's more interesting features and capabilities include:
145 {{B:Choice of databases}}: {{I:Slapd}} comes with three different backend
146 databases you can choose from. They are LDBM, a high-performance disk-based
147 database; SHELL, a database interface to arbitrary UNIX commands or shell
148 scripts; and PASSWD, a simple password file database.
150 {{B:Multiple database instances}}: {{I:Slapd}} can be configured to serve
151 multiple databases at the same time. This means that a single {{I:slapd}}
152 server can respond to requests for many logically different portions
153 of the LDAP tree, using the same or different backend databases.
155 {{B:Generic database API}}: If you require even more customization, {{I:slapd}}
156 lets you write your own backend database easily. {{I:Slapd}}
157 consists of two distinct parts: a front end that handles protocol
158 communication with LDAP clients; and a backend that handles database
159 operations. Because these two pieces communicate via a well-defined
160 C API, you can write your own customized database backend to {{I:slapd}}.
162 {{B:Access control}}: {{I:Slapd}} provides a rich and powerful access
163 control facility, allowing you to control access to the information
164 in your database(s). You can control access to entries based on
165 LDAP authentication information, IP address, domain name and other criteria.
167 {{B:Threads}}: {{I:Slapd}} is threaded for high performance. A
168 single multi-threaded {{I:slapd}} process handles all incoming
169 requests, reducing the amount of system overhead required. {{I:Slapd}}
170 will automatically select the best thread support for your platform.
172 {{B:Replication}}: {{I:Slapd}} can be configured to maintain replica
173 copies of its database. This master/slave replication scheme is
174 vital in high-volume environments where a single {{I:slapd}} just
175 doesn't provide the necessary availability or reliability.
177 {{B:Configuration}}: {{I:Slapd}} is highly configurable through a
178 single configuration file which allows you to change just about
179 everything you'd ever want to change. Configuration options have
180 reasonable defaults, making your job much easier.
182 {{I:Slapd}} also has its limitations, of course. It does not
183 currently handle aliases, which are part of the LDAP model. The
184 main LDBM database backend does not handle range queries or negation
185 queries very well. These features and more will be coming in a future release.
189 H2: What about X.500?
191 LDAP was originally developed as a front end to X.500, the OSI directory
192 service. X.500 defines the Directory Access Protocol (DAP) for clients to
193 use when contacting directory servers. DAP is a heavyweight protocol that
194 runs over a full OSI stack and requires a significant amount of computing
195 resources to run. LDAP runs directly over TCP and provides most of the
196 functionality of DAP at a much lower cost.
198 This use of LDAP makes it easy to access the X.500 directory, but still
199 requires a full X.500 service to make data available to the many LDAP clients
200 being developed. As with full X.500 DAP clients, a full X.500 server is no
201 small piece of software to run.
203 The stand-alone LDAP daemon, or {{I:slapd}}, is meant to remove much of the
204 burden from the server side just as LDAP itself removed much of the burden
205 from clients. If you are already running an X.500 service and you want to
206 continue to do so, you can probably stop reading this guide, which is all
207 about running LDAP via {{I:slapd}}, without running X.500. If you are not
209 want to stop running X.500, or have no immediate plans to run X.500,
212 It is possible to replicate data from a {{I:slapd}} directory
213 server to an X.500 DSA, which allows your organization to make your
214 data available as part of the global X.500 directory service on a
215 "read-only" basis. This is discussed in section 11.6.
217 Another way to make data in a {{I:slapd}} server available to the X.500
218 community would be by using a X.500 DAP to LDAP gateway. At this time, no
219 such software has been written (to the best of our knowledge), but hopefully
220 some group will see fit towrite such a gateway.
224 H2: What is slurpd and what can it do?
226 {{I:Slurpd}} is a UNIX daemon that helps {{I:slapd}} provide
227 replicated service. It is responsible for distributing changes made
228 to the master {{I:slapd}} database out to the various {{I:slapd}}
229 replicas. It frees {{I:slapd}} from having to worry that some
230 replicas might be down or unreachable when a change comes through;
231 {{I:slurpd}} handles retrying failed requests automatically.
232 {{I:Slapd}} and {{I:slurpd}} communicate through a simple text
233 file that is used to log changes.
projects / openldap / blob