The LDAP Protocol…

Amrish KaushikGraduate Student

USC – Computer Science (CN)

Agenda Background and Motivation Understanding LDAP

Information Structure Naming Functions/Operations Security

Protocol Model Mapping onto Transport Services Protocol Element Encoding Discussion

Background and Motivation Increased reliance on networked

computers Need in information

Functionality Ease-of-Use Administration (Application specific dirs) Clear and consistent organization Integrity Confidentiality

X.500 X.500 standard. CCITT 1988

Refer ISO 9594 – X.500-X.521 of 1990

X.500 Organizes directory entries into a

hierarchical namespace Powerful search capabilities Often used for interfacing incompatible

directory services Used DAP for c/s communication DAP (App. Layer) requires ENTIRE OSI

stack to operate Too heavy for small environments

What is LDAP? Lightweight Directory Access Protocol Used to access and update information

in a directory built on the X.500 model Specification defines the content of

messages between the client and the server

Includes operations to establish and disconnect a session from the server

LDAP Server: G/S

Understanding LDAP Lightweight alternative to DAP Uses TCP/IP instead of OSI stack Simplifies certain functions and omits

others… Uses strings rather than DAP’s ASN.1

notation to represent data.

LDAP Information

Structure of information stored in an LDAP directory.

Naming How information is organized and identified.

Functional / Operations Describes what operations can be performed on

the information stored in an LDAP directory. Security

Describes how the information can be protected from unauthorized access.

LDAP Information Storage

LDAP Information Storage Each attribute has a type/syntax and a

value Can define how values behave during

searches/directory operations Syntax: bin, ces, cis, tel, dn etc. Usage limits: ssn – only one, jpegPhoto

– 10K

LDAP Information Storage Each ‘entry’ describes an object (Class)

Person, Server, Printer etc. Example Entry:

InetOrgPerson(cn, sn, ObjectClass) Example Attributes:

cn (cis), sn (cis), telephoneNumber (tel), ou (cis), owner (dn), jpegPhoto (bin)

LDAP Naming DNs consist of sequence of Relative DN

cn=John Smith,ou=Austin,o=IBM,c=US (Leaf 2 Root) (~use \ for special)

Directory Information Tree (DIT) Follow geographical or organizational

scheme Aliases: Tree-like, Aliases can link non-leaf nodes

LDAP Naming Referrals: May not store entire DIT (v3) Referrals

objectClass=referral, attribute=ref, value=LDAPurl

Implementation differs Refferals/Chaining (vendor)

RFC 1777: server chaining is expected.

LDAP Naming Schema

Defines what object classes allowed Where they are stored What attributes they have (objectClass) Which attributes are optional (objectClass) Type/syntax of each attribute (objectClass)

Query server for info: zero-length DN LDAP schema must be readable by the

client

LDAP Naming Examples

Attribute Type String

CommonName CN

LocalityName L

StateorProvinceName ST

OrganizationName O

OrganizationalUnitName OU

CountryName C

StreetAddress STREET

domainComponent DC

Userid UID

LDAP Functions/Operations Authentication

BIND/UNBIND ABANDON

Query Search Compare entry

Update Add an entry Delete an entry (Only Leaf nodes, no aliases) Modify an entry, Modify DN/RDN

Client and Server Interaction Client establishes session with server (BIND)

Hostname/IP and port number Security

User-id/password based authentication Anonymous connection - default access rights Encryption/Kerberos also supported

Client performs operations Read/Update/Search SELECT X,Y,Z FROM PART_OF_DIRECTORY

Client ends the session (UNBIND) Client can ABANDON the session

BIND/UNBIND/ABANDON Request includes LDAP version, the name the

client wants to bind as, authentication type Simple (clear text passwords, anonymous) Kerberos v4 to the LDAP server (krbv42LDAP) Kerberos v4 to the DSA server (krbv42DSA)

Server responds with a status indication UNBIND: Terminates a protocol session

UnbindRequest ::= [APPLICATION 2] NULL ABANDON:

MessageID to abandon

Search/Compare Request includes

baseObject: an LDAPDN Scope: how many levels to be searched derefAliases: handling of aliases sizeLimit: max number of entries returned timeLimit: max time allowed for search attrsOnly: return attribute types OR values also Filter: cond. to be fulfilled when searching Attributes: List of entry’s attributes to be returned

Read and List implemented as searches Compare: similar to search but returns T/F

ADD/MODIFY/DELETE ADD request

Entry: LDAPDN List of Attributes and values (or sets of values)

MODIFY request Used to add, delete, modify attributes Request includes

Object: LDAPDN List of modifications (atomic)

Add, Delete, Replace

DELETE request Object: LDAPDN

Protocol Elements LDAPMessage (MessageID unique)

Protocol Elements LDAPString ::= OCTET STRING LDAPDN ::= LDAPString RelativeLDAPDN ::= LDAPString AttributeValueAssertion ::=

Sequence {attributeType attributeValue,

attributeValue attributeValue}

attributeType ::= LDAPString

Protocol Elements LDAP Result Errors

Truncated DIT RDN sequence is sent

noSuchObject aliasProblem invalidDNSyntax isLeaf etc.

LDAP Security Current LDAP version supports

Clear text passwords KERBEROS version 4 authentication

Other authentication methods possible in future versions (March 1995)

SASL support added in version 3 Kerberos deemed stronger than SASL…

LDAP Security Security based on the BIND model Clear text ver 1 Kerberos ver 1,2,3 (depr) SASL ver 3

Simple Authentication and Security Layer uses one of many authentication methods

Proposal for Transport Layer Security Based on SSL v3 from Netscape

LDAP Security No Authentication Basic Authentication

DN and password provided Clear-text or Base 64 encoded

SASL (RFC 2222) Parameters: DN, mechanism, credentials Provides cross protocol authentication calls Encryption can be optionally negotiated ldap_sasl_bind() (ver3 call) Ldap://<ldap_server>/?supportedsaslmechanisms

LDAP Security LDAP using SASL using SSL/TLS

LDAP Security SSL/TLS Handshake

Agenda Background and Motivation Understanding LDAP

Information Structure Naming Functions/Operations Security

Protocol Model Mapping onto Transport Services Protocol Element Encoding Discussion

Protocol Model Clients performing protocol operations

against servers Client sends protocol request to server Server performs operation on directory Server returns response (results/errors)

Asynchronous Server Behavior

Directory Client/Server Interaction

Mapping onto Transport Uses Connection-oriented, reliable transport TCP

LDAPMessage PDU mapped onto TCP byte stream LDAP listener on port 389

Connection Oriented Transport Service (COTS) LDAP PDU is mapped directly onto T-Data

Protocol Element Encoding Encoded for Exchange using BER (Basic

Encoding Rules) BER defined in Abstract Syntax Notation

One (ASN.1) High Overhead for BER

Restrictions imposed to improve perf. Definite form of length encoding only Bit Strings/ Octet Strings and all character

string types encoded in primitive form only

LDAP Implementations C Library API

LDAPv2 - RFC 1823 ‘The LDAP API’ LDAPv3 – In Internet Draft stage

Java JNDI LDAP v3 uses the UTF-8 encoding of

the Unicode character set. HTTP to LDAP gateway LDAP to X.500 gateway – ldapd

Version 2 v/s Version 3 Referrals

A server that does not store the requested data can refer the client to another server.

Security Extensible authentication using Simple

Authentication and Security Layer (SASL) Internationalization

UTF-8 support for international characters. Extensibility

New object types and operations can be dynamically defined and schema published in a