LDAP Primer

When I talk with most CPS customers, they are not the actual LDAP administrator, and really have no interest in learning LDAP at all. They just need to implement CPS to complete their WPS rollout. However, before you begin configuring CPS for LDAP integration, here are some pointers and terms about LDAP you should know:

• LDAP stands for Lightweight Directory Access Protocol.
  • LDAP is a protocol for accessing Directory Services (for example, Microsoft Active Directory/Exchange, IPlanet Directory Server, Novell Directory Services, and so forth).
  • CPS supports LDAP version 3 compliant LDAP servers (RFC 2251).
• LDAP servers contain objects─everything is represented as an object.
• LDAP objects are stored in a hierarchical structure called the DIT (Directory Information Tree) and organized into nodes or branches (also called leaves)–see Figure 1 below.
• Each object has properties (called attributes) and instantiates one or more object class (specified in the objectClass attribute).
  • An objectClass is both an attribute and an object.
  • An objectClass can be subclassed and most extend the top object class (objectClass=top).
• Object properties are stored in name/value pairs.
• Each object contains a distinguished name (dn) attribute which uniquely identifies the object in the DIT.
• Typical LDAP attributes are:
  • dn (Distinquished Name)–uniquely identifies an object in the DIT
  • cn (Common Name)–a common or full name for an object in the DIT
  • uid (User ID)–a user id for a user object
  • sAMAccountName–Windows domain logon name (Active Directory/Exchange Server only)
  • mail (Email)–an object’s e-mail attribute
  • objectClass (Object Class)–a grouping of attributes
  • ou (organizationalUnit)–typically a department within an organization
  • o (organization)–typically an organization within a company
  • dc (domain component)–A portion of the domain name (or DNS name)

Note: LDAP attribute names are usually case-insensitive, but it is best practice to use the correct case (or mix-case) in spelling them.

Your company’s user directory is an LDAP server (or a server implementing a version 3 LDAP interface) and contains user and group objects─each with their own respective DN attributes. The user objects are organized into groups for better management. Contribute users authenticate to the user directory with their username (or DN) and password. Administrators assign rights and permissions to groups, and it is the user’s group membership that provides authorized access.

Now that you have an idea of the LDAP components you will be dealing with, I will review setting up the CPS LDAP settings.

Figure 1. An example directory information tree

Page 2 of 5

Previous Page

Next Page