2 # Copyright 1999-2000, The OpenLDAP Foundation, All Rights Reserved.
3 # COPYING RESTRICTIONS APPLY, see COPYRIGHT.
4 H1: Introduction to slapd and slurpd
6 This document describes how to build, configure, and run the stand-alone
7 LDAP daemon ({{I:slapd}}) and the stand-alone LDAP update replication
8 daemon ({{I:slurpd}}). It is intended for newcomers and experienced
9 administrators alike. This section provides a basic introduction to directory
10 service, and the directory service provided by {{I:slapd}} in particular.
14 H2: What is a directory service?
16 A directory is specialized database optimized for reading, browsing and
17 searching. Directories tend to contain descriptive, attribute-based
18 information and support sophisticated filtering capabilities. Directories
19 are generally do not support complicated transaction or roll-back schemes
20 found in database management systems designed for handling high-volume
21 complex updates. Directory updates are typically simple all-or-nothing
22 changes, if they are allowed at all. Directories are tuned to give
23 quick-response to high-volume lookup or search operations. They may have
24 the ability to replicate information widely in order to increase
25 availability and reliability, while reducing response time. When
26 directory information is replicated, temporary inconsistencies between
27 the replicas may be OK, as long as they get in sync eventually.
29 There are many different ways to provide a directory service. Different
30 methods allow different kinds of information to be stored in the directory,
31 place different requirements on how that information can be referenced,
32 queried and updated, how it is protected from unauthorized access, etc.
33 Some directory services are {{I:local}}, providing service to a restricted
34 context (e.g., the finger service on a single machine). Other services are
35 global, providing service to a much broader context (e.g., the entire Internet).
36 Global services are usually {{I:distributed}}, meaning that the data they
37 contain is spread across many machines, all of which cooperate to provide
38 the directory service. Typically a global service defines a uniform
39 {{I:namespace}} which gives the same view of the data no matter where
40 you are in relation to the data itself. The Internet {{Domain Name System}}
41 is an example of a globally distributed directory service.
47 {{I:Slapd}}'s model for directory service is based on a global directory
48 model called {{TERM:LDAP}}. LDAP stands for {{TERM[expand]LDAP}}.
49 LDAP is a directory access protocol that runs over
50 {{TCP/IP}}. The nitty-gritty details of LDAP are defined in
51 {{REF:RFC2251}} "The Lightweight Directory Access Protocol (v3)."
52 This section gives an overview of LDAP from a user's perspective.
54 {{I:What kind of information can be stored in the directory?}}
55 The LDAP information model is based on {{entries}}. An entry is a
56 collection of attributes that has a globally-unique {{distinguished
58 The DN is used to refer to the entry unambiguously. Each of the
59 entry's attributes has a {{type}} and one or more {{values}}.
60 The types are typically mnemonic strings, like "{{EX:cn}}" for common
61 name, or "{{EX:mail}}" for email address. The syntax of values depend
62 on the attribute type is. For example, {{EX:cn}} attribute might
63 be the value {{EX: Babs Jensen}}. A {{EX:mail}} attribute might
64 contain the value "{{EX:babs@openldap.org}}". A {{EX:jpegPhoto}}
65 attribute would contain a photograph in the JPEG (binary) format.
67 {{I:How is the information arranged?}}
68 In LDAP, directory entries are arranged in a hierarchical tree-like
69 structure. Traditionally, this structure reflected the geographic
70 and/or organizational boundaries. Entries representing countries
71 appeared at the top of the tree. Below them are entries representing
72 states and national organizations. Below them might be entries
73 representing organizational units, people, printers, documents,
74 or just about anything else you can think of. Figure 1.1 shows an
75 example LDAP directory tree using traditional naming.
77 !import "intro_tree.gif"; align="center"; \
78 title="LDAP directory tree (traditional naming)"
79 FT[align="Center"] Figure 1.1: LDAP directory tree (traditional naming)
81 The tree may also be arranged based upon Internet domain names.
82 Figure 1.2 shows an example using this increasing popular naming approach.
84 !import "intro_dctree.gif"; align="center"; \
85 title="LDAP directory tree (Internet naming)"
86 FT[align="Center"] Figure 1.2: LDAP directory tree (Internet naming)
88 In addition, LDAP allows you to control which attributes are required
89 and allowed in an entry through the use of a special attribute called
90 {{I:objectClass}}. The values of the {{I:objectClass}} attribute
91 determine the {{I:schema}} rules the entry must obey.
93 {{I:How is the information referenced?}}
94 An entry is referenced by its distinguished name, which is constructed
95 by taking the name of the entry itself (called the relative distinguished
96 name, or RDN) and concatenating the names of its ancestor entries. For
97 example, the entry for Barbara Jensen in the Internet naming example
98 above has an RDN of {{EX:uid=babs}} and a DN of
99 {{EX:uid=babs, ou=People, dc=OpenLDAP, dc=com}}". The full DN format is
100 described in {{REF:RFC2253}}, "Lightweight Directory Access Protocol (v3):
101 UTF-8 String Representation of Distinguished Names."
103 {{I:How is the information accessed?}}
104 LDAP defines operations for interrogating and updating the directory.
105 Operations are provided for adding and deleting
106 an entry from the directory, changing an existing entry, and changing the
107 name of an entry. Most of the time, though, LDAP is used to search for
108 information in the directory. The LDAP search operation allows some portion
109 of the directory to be searched for entries that match some criteria specified
110 by a search filter. Information can be requested from each entry that matches
113 For example, you might want to search the entire directory subtree at
114 and below {{EX:dc=OpenLDAP,dc=org}} for people with the name {{EX:Barbara
115 Jensen}}, retrieving the email address of each entry found. LDAP lets
116 you do this easily. Or you might want to search the entries directly
117 below the {{EX:st=California, c=US}} entry for organizations with the
118 string {{EX:Acme}} in their name, and that have a fax number. LDAP lets
119 you do this too. The next section describes in more detail what you can
120 do with LDAP and how it might be useful to you.
122 {{I:How is the information protected from unauthorized access?}}
123 Some directory services provide no protection, allowing anyone to see
124 the information. LDAP provides a method for a client to authenticate,
125 or prove its identity to a directory server, paving the way for rich
126 access control to protect the information the server contains.
129 H2: How does LDAP work?
131 LDAP directory service is based on a {{I:client-server}} model. One or more
132 LDAP servers contain the data making up the LDAP directory tree. An LDAP
133 client connects to an LDAP server and asks it a question. The server
134 responds with the answer and/or with a pointer to where the client can
135 get additional information (typically, another LDAP server). No matter
136 which LDAP server a client connects to, it sees the same view of the
137 directory; a name presented to one LDAP server references the same
138 entry it would at another LDAP server. This is an important feature of
139 a global directory service, like LDAP.
142 H2: What is slapd and what can it do?
144 {{I:Slapd}} is an LDAP directory server that runs on many different
145 platforms. You can use it to provide a directory service of your very own.
146 Your directory can contain pretty much anything you want to put in it. You
147 can connect it to the global LDAP directory service, or run a service all by
148 yourself. Some of slapd's more interesting features and capabilities include:
150 {{B:Choice of databases}}: {{I:Slapd}} comes with a variety of different
151 backend databases you can choose from. They include LDBM, a high-performance
152 disk-based {{embedded}} database; SHELL, a database interface to arbitrary
153 shell scripts; and PASSWD, a simple password file database.
155 {{B:Multiple database instances}}: {{I:Slapd}} can be configured to serve
156 multiple databases at the same time. This means that a single {{I:slapd}}
157 server can respond to requests for many logically different portions
158 of the LDAP tree, using the same or different backend databases.
160 {{B:Generic database API}}: If you require even more customization,
161 {{I:slapd}} lets you write your own backend database easily. {{I:Slapd}}
162 consists of two distinct parts: a front end that handles protocol
163 communication with LDAP clients; and a backend that handles database
164 operations. Because these two pieces communicate via a well-defined
165 C API, you can write your own customized database backend to {{I:slapd}}.
166 A number of {{programmable}} backends are also provided.
168 {{B:Access control}}: {{I:Slapd}} provides a rich and powerful access
169 control facility, allowing you to control access to the information
170 in your database(s). You can control access to entries based on
171 LDAP authentication information, IP address, domain name and other criteria.
173 {{B:Threads}}: {{I:Slapd}} is threaded for high performance. A
174 single multi-threaded {{I:slapd}} process handles all incoming
175 requests, reducing the amount of system overhead required. {{I:Slapd}}
176 will automatically select the best thread support for your platform.
178 {{B:Replication}}: {{I:Slapd}} can be configured to maintain replica
179 copies of its database. This master/slave replication scheme is
180 vital in high-volume environments where a single {{I:slapd}} just
181 doesn't provide the necessary availability or reliability.
183 {{B:Configuration}}: {{I:Slapd}} is highly configurable through a
184 single configuration file which allows you to change just about
185 everything you'd ever want to change. Configuration options have
186 reasonable defaults, making your job much easier.
188 {{I:Slapd}} also has its limitations, of course. The main LDBM
189 database backend does not handle range queries or negation queries
190 very well. These features and more will be coming in a future release.
194 H2: What about X.500?
196 Technically, LDAP is a directory access protocol to an X.500 directory
197 service, the OSI directory service. Initial LDAP servers were
198 were gateway between LDAP and the X.500 Directory Access Protocol (DAP).
199 DAP is a heavyweight protocol that runs over a full OSI stack and
200 requires a significant amount of computing resources to run. LDAP
201 runs directly over TCP and provides most of the functionality of DAP
202 at a much lower cost.
204 This use of LDAP makes it easy to access the X.500 directory, but still
205 requires a full X.500 service to make data available to the many LDAP
206 clients being developed. As with full X.500 DAP clients, a full X.500
207 DAP server is no small piece of software to run.
209 The stand-alone LDAP daemon, or {{I:slapd}}(8), is meant to remove much
210 of the burden from the server side just as LDAP itself removed much of
211 the burden from clients. If you are already running an X.500 DAP service
212 and you want to continue to do so, you can probably stop reading this
213 guide, which is all about running LDAP via {{I:slapd}}, without running
214 X.500 DAP. If you are not running X.500 DAP, want to stop running
215 X.500 DAP, or have no immediate plans to run X.500 DAP, read on.
217 It is possible to replicate data from a {{I:slapd}} directory
218 server to a X.500 DSA, which allows your organization to make your
219 data available as part of the global X.500 DAP directory service
220 on a "read-only" basis. This is discussed in section 11.6.
222 Another way to make data in a {{I:slapd}} server available to the
223 X.500 community would be by using a X.500 DAP to LDAP gateway. At
224 this time, no such software has been written (to the best of our
225 knowledge), but hopefully some group will see fit to write such a
229 H2: What is slurpd and what can it do?
231 {{I:Slurpd}}(8) is a daemon that helps {{I:slapd}} provide
232 replicated service. It is responsible for distributing changes made
233 to the master {{I:slapd}} database out to the various {{I:slapd}}
234 replicas. It frees {{I:slapd}} from having to worry that some
235 replicas might be down or unreachable when a change comes through;
236 {{I:slurpd}} handles retrying failed requests automatically.
237 {{I:Slapd}} and {{I:slurpd}} communicate through a simple text
238 file that is used to log changes.
projects / openldap / blob