Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE Guida di Installazione Scaricare il pdf (Pagina 249)

Chapter 19.

Lightweight Directory Access Protocol (LDAP)

19.1. What is LDAP?

LDAP (Lightweight Directory Access Protocol) is a proposed open standard for accessing global or

local directory services over a network and/or the Internet. A directory, in this sense, is very much

like a phone book. LDAP can handle other information, but at present it is typically used to associate

names with phone numbers and email addresses. LDAP directories are designed to support a high

volume of queries, but the data stored in the directory does not change very often.

LDAP is much more useful than a paper phone book, because LDAP’s design is intended to support

propagation over LDAP servers throughout the Internet, much like the Domain Name Service (DNS).

DNS servers help to connect computers to one another based on fully qualiﬁed domain names or

the type of service requested from a domain, such as mail exchange. Without DNS servers, hostnames

could not be translated into IP addresses, which are required for TCP/IP communication. In the future,

LDAP could provide the same type of global access to many types of directory information. Currently,

LDAP is more commonly used within a single large organization, like a college or a company, for

directory services.

LDAP is a client-server system. An LDAP client connects to an LDAP server and either queries

it for information or provides information that needs to be entered into the directory. The server

either answers the query, refers the query to another LDAP server, or accepts the information for

incorporation into the directory, based on the permission of the user.

LDAP is sometimes known as X.500 Lite. X.500 is an international standard for directories and full-

featured, but it is also complex, requiring a lot of computing resources and the full OSI stack. LDAP,

in contrast, can run easily on a PC and over TCP/IP. LDAP can access X.500 directories but does not

support every capability of X.500.

This chapter will refer to the conﬁguration and use of OpenLDAP, an open source implementation

of LDAP. OpenLDAP includes slapd (a stand-alone LDAP server), slurpd (a stand-alone LDAP

replication server), libraries implementing the LDAP protocol, utilities, tools, and sample clients.

19.2. Pros and Cons of LDAP

The main beneﬁt of using LDAP is the consolidation of certain types of information within your

organization. For example, all of the different lists of users within your organization can be merged

into one LDAP directory. This directory can be queried by any LDAP-enabled applications that need

this information. It can also be used by users who need directory information.

Other LDAP beneﬁts include its ease of implementation (compared to X.500) and its well-deﬁned Ap-

plication Programming Interface (API), which means that the number of LDAP-enabled applications

and LDAP gateways should increase in the future.

On the negative side, if you want to use LDAP, you will need LDAP-enabled applications or the ability

to use LDAP gateways. While LDAP usage should only increase, currently there are not very many

LDAP-enabled applications available for Linux. Also, while LDAP does support some access control,

it does not possess as many security features as X.500.

1 2 ... 244 245 246 247 248 249 250 251 252 253 254 ... 281 282

Nessun commento

Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE Guida di Installazione Pagina 249