Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE Guida di Installazione Scaricare il pdf (Pagina 250)

250 Chapter 19. Lightweight Directory Access Protocol (LDAP)

19.3. Uses for LDAP

Several Netscape applications, including web browsers using the Netscape Roaming Access feature,

are LDAP-enabled. Sendmail can use LDAP to look up addresses. Evolution has LDAP support.

Your organization can use LDAP as an organization-wide directory and/or name service (in place of

NIS or ﬂat ﬁles). You can even use a personal LDAP server to keep track of your own email address

book (see Section 19.11).

Since LDAP is an open and conﬁgurable protocol, it can be used to store almost any type of informa-

tion relating to a particular organizational structure.

19.3.1. LDAP Applications

Several LDAP client applications are available that greatly simplify viewing and changing LDAP

information:

• LDAP Browser/Editor — A user-friendly tool written in 100% Java for easy deployment across

different platforms, available at http://www.iit.edu/~gawojar/ldap

• GQ — A GTK-based LDAP client, available with the Red Hat Linux 7.3 distribution or at

http://biot.com/gq

19.3.2. LDAP and PAM

LDAP can be used as an authentication service via the pam_ldap module. LDAP is commonly used

as a central authentication server so that users have a uniﬁed login that covers console logins, POP

servers, IMAP servers, machines connected to the network using Samba, and even Windows NT/2000

machines. Using LDAP, all of these login situations can rely on the same user ID and password

combination, greatly simplifying administration. The pam_ldap module is provided in the nss_ldap

package.

19.4. LDAP Terminology

An entry is one unit in an LDAP directory. An entry is identiﬁed or referenced by its unique Distin-

guished Name (DN).

An entry has attributes, which are pieces of information directly associated with the entry. For ex-

ample, an organization could be an LDAP entry. Attributes associated with the organization might be

its fax number, its address, and so on. People can also be entries in the LDAP directory. Common

attributes for people include their telephone numbers and their e-mail addresses.

Certain attributes are required, while other attributes are optional. An objectclass sets which attributes

are required and which are optional. Objectclass deﬁnitions are found in various schema ﬁles, located

in the /etc/openldap/schema directory.

The LDAP Data Interchange Format (LDIF) is an ASCII text format for LDAP entries. Files that

import or export data to and from LDAP servers must be in LDIF format. An LDIF entry looks like

this:

[

id ]

dn: distinguished name

attrtype : attrvalue

1 2 ... 245 246 247 248 249 250 251 252 253 254 255 ... 281 282

Nessun commento

Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE Guida di Installazione Pagina 250