Behind the Basics: The LDAP Protocol itself, plus Schema, Attributes, and Directory Organization

A section of An LDAP Roadmap & FAQ: A tutorial aid to navigating various LDAP and X.500 resources on the Internet, v2.0a

by: Jeff Hodges
Under Construction
   This is v2.0a -- a "beta" release -- it is still way under construction. You will find version 1.5, which may or may not be more up-to-date, HERE. Apologies for any confusion. 
This section last updated: 17-Feb-1999
 Back to the main LDAP Roadmap page v2.0a

Begin with this section if you understand the Basics and are wondering about stuff such as the protocol itself, attributes, their syntaxes, object classes, etc.

There are two versions of the LDAP protocol: LDAPv2 and LDAPv3. I discuss both in turn below, beginning with LDAPv3. Following subsections on both, there are subsections on schema, URLs, filters, etc. You can skip reading about the protocol itself if just you want to learn about schema elements and such and dive into laying out your directory. But to really understand how this all works, looking over the protocol docs is useful.

Section Contents

The LDAP Protocol Itself:

Elements of Schema: Object Classes, Attributes, and Distinguished Names

Here's a condensed way of explaining how all this LDAP information model stuff (i.e. schema stuff) fits together.. The documents below specify and/or explain this in greater detail.

Overall Background Specification Docs:

LDAPv3 Schema Elements:

LDAPv2 Schema Elements:

Distinguished Names (DNs):

DNs are functionally akin to primary keys in RDBMSs (relational database management systems). As introduced above, an object in an LDAP/X.500-based directory has a DN. The DN is syntactically analogous to a fully-qualified domain name in that the object also has a "local" name, called its Relative Distinguished Name (RDN). The below documents are properly part of the LDAPv3 and LDAPv2 protocols because DNs in the form of strings are carried directly in protocol in LDAP. Additionally, in LDAPv3's case, the LDAP URL document (RFC2255, see below) is officially considered part of the LDAPv3 protocol core (see this page for details) and thus RFC2253 is necessary because DN strings are defined as part of LDAP URLs in RFC2255.

LDAPv3 Distinguished Names Representation

LDAPv2 Distinguished Names Representation

LDAP URLs and Search Filters:

LDAPv2 did not officially specify a string representation for LDAP Search Filters. Search Filters are encoded in LDAP PDUs using BER (see below) according to the ASN.1 syntax for them specified in RFC1777. BER-encoding an object gives you a binary object that isn't particularly readable. Having a "string representation" of things such as search filters is useful for APIs and necessary for constructs like URIs and URLs, which are text-string based. So, the string representation of LDAP search filters (RFC1960) was created along with the LDAP URL format (RFC1959) and is utilized by the LDAP API (RFC1823).

Release 3.3 of the UMich LDAPv2 implementation (see this page) implements RFCs 1959, 1960, and 1823, as do many other LDAPv2 implementations. However, those three RFCs are not officially "part" of LDAPv2.

The LDAP URL, DN string representation, and search filter representation concepts were officially rolled into the core of the LDAPv3 protocol family (see this page). The documents representing them are being progressed along the standards track along with RFC2251.

There is an IETF effort underway to produce an LDAPv3 API, which will reference the below docs, although it is currently constituted as an Internet-Draft. See the section on LDAP APIs for more information.



 Also in terms of URI/URLs, there is this document which is applicable to either LDAPv2 or v3...

LDAP API Specifications:

The IETF officially doesn't "do" APIs -- at this point in time, that is. There are movements afoot within the IETF to do so. An example of this is the GSSAPI which is at Proposed Standard maturity level.

First up, Tim Howes & Mark Smith authored this book on how to utilize the LDAPv2 API to build directory-enabled applications...

It is a must-read if you need to learn the ins-and-outs of utilizing any of the LDAP APIs.


There are not yet any RFC-level documents for LDAPv3 APIs. Work is on-going and there are several current Internet-Draft documents. There is a set for C and a document for Java. First, the C docs... The Java API doc... Also, see [Howes&Smith97] above.


The work on the LDAPv2 API is finished. It culminated in this document... ..which is an Informational RFC, i.e. it does not denote any sort of official standard. Effectively, though, it is widely regarded in the LDAP community as the de-facto standard LDAP API document. This API is implemented in "libldap.a", the code to which is available at the UMich LDAP/X.500 client, server, and general resource repository.  See this page for more information on various client library implementations.

Also, see [Howes&Smith97] above.

Encodings for Protocol and Data:

The document below discusses the details of how information in the LDAP protocol is overall encoded. The documents below discuss the UTF-8 transformation format of the ISO 10646 character set, which are specified by LDAPv3 as the encoding algorithm and character set for all the protocol's string types, respectively. Note that ISO 10646 and UNICODE are related. UNICODE is advertised as a proper subset of the former.

Directory Organization and Layout:

These documents are relevant to either LDAPv2 or LDAPv3. They discuss Directory attributes and their syntaxes. You should read this stuff if you're setting up your directory and mapping your organization's information into it and/or if you're creating new object classes or attributes.
The next section of these Roadmap pages provides pointers to documents describing how to locate LDAP directory services, other transport for LDAP, mapping the DNS onto LDAP-based directories, etc. 
Back to the LDAP Roadmap table of contents...
Back to the LDAP FAQ contents...
Back to the main LDAP Roadmap & FAQ page...

© 1996-1999 Jeff Hodges, All Rights Reserved