Overview

• What you will learn: The Lightweight Directory Access Protocol (LDAP) and its data model (entries, attributes, objectClasses, the Directory Information Tree), how to install and configure OpenLDAP (slapd) on Ubuntu, manage directory content with LDIF files and ldap utilities (ldapsearch, ldapadd, ldapmodify, ldapdelete), understand and extend schemas, configure Access Control Lists for fine-grained authorization, and enable TLS encryption.
• Prerequisites: Lesson 49 (Kerberos Authentication), familiarity with DNS and X.509 certificates
• Estimated reading time: 30 minutes

Introduction

A directory service is a specialized database optimized for reading, searching, and browsing hierarchical data. While relational databases excel at transactional workloads, directories are designed for storing identity information — user accounts, groups, organizational units, hosts, and certificates — that is read far more often than it is written.

LDAP (Lightweight Directory Access Protocol) is the standard protocol for accessing directory services. It defines how clients query and modify directory entries, how the data is structured in a tree hierarchy, and how entries are identified by Distinguished Names (DNs). OpenLDAP is the most widely deployed open-source LDAP server on Linux.

In this lesson you will learn the LDAP data model, install and configure the OpenLDAP server (slapd) on Ubuntu, populate the directory with user and group entries, apply schemas, and configure access control lists to secure directory data.

LDAP Data Model

The Directory Information Tree (DIT)

LDAP organizes data in a tree structure called the Directory Information Tree. Each node in the tree is an entry identified by a Distinguished Name (DN) that describes the path from the entry to the root of the tree.

# Example DIT structure
dc=example,dc=com                          # Root (domain component)
├── ou=People,dc=example,dc=com            # Organizational Unit
│   ├── uid=alice,ou=People,dc=example,dc=com
│   └── uid=bob,ou=People,dc=example,dc=com
├── ou=Groups,dc=example,dc=com
│   ├── cn=developers,ou=Groups,dc=example,dc=com
│   └── cn=admins,ou=Groups,dc=example,dc=com
└── ou=Services,dc=example,dc=com

Entries, Attributes, and ObjectClasses

Each entry consists of a set of attributes. Attributes have a type (e.g., cn, uid, mail) and one or more values. The set of allowed and required attributes is determined by the entry’s objectClass values.

• Structural objectClass: Defines the core attribute set (every entry must have exactly one). Examples: inetOrgPerson, organizationalUnit, posixAccount.
• Auxiliary objectClass: Adds optional attributes to an entry. Example: posixAccount adds uidNumber, gidNumber, homeDirectory.

Installing and Configuring OpenLDAP

# Install slapd and LDAP utilities
$ sudo apt install slapd ldap-utils

# During installation you will be prompted to set the admin password
# The default base DN is derived from the system domain name

# Reconfigure if needed
$ sudo dpkg-reconfigure slapd
# - Omit OpenLDAP config? No
# - DNS domain name: example.com  (creates dc=example,dc=com)
# - Organization name: Example Inc
# - Admin password: (strong password)
# - Database backend: MDB
# - Remove database when slapd is purged? No
# - Move old database? Yes

Verify the Installation

# Check slapd is running
$ sudo systemctl status slapd

# Search the base DN
$ ldapsearch -x -LLL -H ldap:/// -b "dc=example,dc=com" "(objectClass=organization)"
dn: dc=example,dc=com
objectClass: top
objectClass: dcObject
objectClass: organization
o: Example Inc
dc: example

# The -x flag means simple authentication (as opposed to SASL)
# -LLL suppresses comments and version information

Managing Directory Content with LDIF

LDIF (LDAP Data Interchange Format) is the standard text format for representing LDAP entries and modifications. All directory changes are expressed as LDIF files.

Adding Organizational Units

# base-ous.ldif
dn: ou=People,dc=example,dc=com
objectClass: organizationalUnit
ou: People

dn: ou=Groups,dc=example,dc=com
objectClass: organizationalUnit
ou: Groups

# Add to the directory
$ ldapadd -x -D "cn=admin,dc=example,dc=com" -W -f base-ous.ldif
Enter LDAP Password:
adding new entry "ou=People,dc=example,dc=com"
adding new entry "ou=Groups,dc=example,dc=com"

Adding User Entries

# user-alice.ldif
dn: uid=alice,ou=People,dc=example,dc=com
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
uid: alice
cn: Alice Chen
sn: Chen
givenName: Alice
mail: alice@example.com
uidNumber: 10001
gidNumber: 10001
homeDirectory: /home/alice
loginShell: /bin/bash
userPassword: {SSHA}hashed_password_here

# Generate a password hash
$ slappasswd -s "securepassword"
{SSHA}W3ipFbMLsxKtF...

# Add the user
$ ldapadd -x -D "cn=admin,dc=example,dc=com" -W -f user-alice.ldif

Modifying and Deleting Entries

# modify-alice.ldif — change email and add a phone number
dn: uid=alice,ou=People,dc=example,dc=com
changetype: modify
replace: mail
mail: alice.chen@example.com
-
add: telephoneNumber
telephoneNumber: +886-2-1234-5678

# Apply the modification
$ ldapmodify -x -D "cn=admin,dc=example,dc=com" -W -f modify-alice.ldif

# Delete an entry
$ ldapdelete -x -D "cn=admin,dc=example,dc=com" -W 
    "uid=bob,ou=People,dc=example,dc=com"

Searching the Directory

# Search for all users
$ ldapsearch -x -LLL -b "ou=People,dc=example,dc=com" "(objectClass=posixAccount)" 
    uid cn mail uidNumber

# Search by attribute
$ ldapsearch -x -LLL -b "dc=example,dc=com" "(uid=alice)"

# Search with a filter
$ ldapsearch -x -LLL -b "ou=People,dc=example,dc=com" 
    "(&(objectClass=posixAccount)(uidNumber>=10000))" uid cn

# Count results
$ ldapsearch -x -b "dc=example,dc=com" "(objectClass=posixAccount)" dn | 
    grep "^dn:" | wc -l

Schemas

Schemas define the attribute types and objectClasses available in the directory. OpenLDAP loads schemas from /etc/ldap/schema/ using the cn=config backend.

# List loaded schemas
$ ldapsearch -Q -LLL -Y EXTERNAL -H ldapi:/// 
    -b "cn=schema,cn=config" "(objectClass=olcSchemaConfig)" dn
dn: cn={0}core,cn=schema,cn=config
dn: cn={1}cosine,cn=schema,cn=config
dn: cn={2}nis,cn=schema,cn=config
dn: cn={3}inetorgperson,cn=schema,cn=config

# Load an additional schema (e.g., RADIUS)
$ sudo ldapadd -Q -Y EXTERNAL -H ldapi:/// 
    -f /etc/ldap/schema/misc.ldif

Access Control Lists (ACLs)

OpenLDAP ACLs control who can read, write, and search directory entries. ACLs are configured in the cn=config database using the olcAccess attribute.

# View current ACLs
$ sudo ldapsearch -Q -LLL -Y EXTERNAL -H ldapi:/// 
    -b "olcDatabase={1}mdb,cn=config" olcAccess

# Example ACL configuration (acl-update.ldif)
dn: olcDatabase={1}mdb,cn=config
changetype: modify
replace: olcAccess
olcAccess: {0}to attrs=userPassword
  by self write
  by anonymous auth
  by * none
olcAccess: {1}to attrs=shadowLastChange
  by self write
  by * read
olcAccess: {2}to dn.subtree="ou=People,dc=example,dc=com"
  by self read
  by users read
  by * none
olcAccess: {3}to *
  by dn="cn=admin,dc=example,dc=com" write
  by users read
  by * none

# Apply ACL changes
$ sudo ldapmodify -Q -Y EXTERNAL -H ldapi:/// -f acl-update.ldif

Enabling TLS Encryption

# Configure TLS (tls-config.ldif)
dn: cn=config
changetype: modify
replace: olcTLSCACertificateFile
olcTLSCACertificateFile: /etc/ssl/certs/ca-certificates.crt
-
replace: olcTLSCertificateFile
olcTLSCertificateFile: /etc/ldap/ssl/ldap-server.crt
-
replace: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/ldap/ssl/ldap-server.key

# Apply TLS configuration
$ sudo ldapmodify -Q -Y EXTERNAL -H ldapi:/// -f tls-config.ldif

# Restart slapd
$ sudo systemctl restart slapd

# Test with STARTTLS
$ ldapsearch -x -ZZ -H ldap://ldap.example.com -b "dc=example,dc=com" "(objectClass=organization)"

Key Takeaways

• LDAP is a protocol for accessing hierarchical directory data; entries are identified by Distinguished Names (DNs) within a Directory Information Tree (DIT).
• Each entry’s allowed attributes are determined by its objectClasses, which are defined in schemas loaded into the server.
• OpenLDAP (slapd) on Ubuntu is configured via the cn=config backend; directory content is managed with LDIF files and the ldapadd, ldapmodify, ldapdelete, and ldapsearch commands.
• Access Control Lists define who can read, write, and authenticate against directory entries — always protect the userPassword attribute.
• Enable TLS encryption for all LDAP connections to prevent credentials and directory data from being transmitted in cleartext.

What’s Next

In the next lesson you will learn about SSSD and Active Directory Integration — how to join Ubuntu servers to an Active Directory domain and provide centralized authentication using SSSD.

# DIT 結構範例
dc=example,dc=com                          # 根（域元件）
├── ou=People,dc=example,dc=com            # 組織單位
│   ├── uid=alice,ou=People,dc=example,dc=com
│   └── uid=bob,ou=People,dc=example,dc=com
└── ou=Groups,dc=example,dc=com

# 安裝 slapd 和 LDAP 工具
$ sudo apt install slapd ldap-utils

# 重新設定
$ sudo dpkg-reconfigure slapd

# 驗證安裝
$ ldapsearch -x -LLL -H ldap:/// -b "dc=example,dc=com" "(objectClass=organization)"

# 添加組織單位（base-ous.ldif）
dn: ou=People,dc=example,dc=com
objectClass: organizationalUnit
ou: People

# 添加到目錄
$ ldapadd -x -D "cn=admin,dc=example,dc=com" -W -f base-ous.ldif

# 添加使用者項目
$ ldapadd -x -D "cn=admin,dc=example,dc=com" -W -f user-alice.ldif

# 修改項目
$ ldapmodify -x -D "cn=admin,dc=example,dc=com" -W -f modify-alice.ldif

# 刪除項目
$ ldapdelete -x -D "cn=admin,dc=example,dc=com" -W "uid=bob,ou=People,dc=example,dc=com"

# 搜尋所有使用者
$ ldapsearch -x -LLL -b "ou=People,dc=example,dc=com" "(objectClass=posixAccount)" uid cn mail

# 按屬性搜尋
$ ldapsearch -x -LLL -b "dc=example,dc=com" "(uid=alice)"

# 列出已載入的綱要
$ ldapsearch -Q -LLL -Y EXTERNAL -H ldapi:/// 
    -b "cn=schema,cn=config" "(objectClass=olcSchemaConfig)" dn

# 查看當前 ACL
$ sudo ldapsearch -Q -LLL -Y EXTERNAL -H ldapi:/// 
    -b "olcDatabase={1}mdb,cn=config" olcAccess

# DIT 構造の例
dc=example,dc=com                          # ルート
├── ou=People,dc=example,dc=com            # 組織単位
│   ├── uid=alice,ou=People,dc=example,dc=com
│   └── uid=bob,ou=People,dc=example,dc=com
└── ou=Groups,dc=example,dc=com

# slapd と LDAP ユーティリティのインストール
$ sudo apt install slapd ldap-utils

# 再設定
$ sudo dpkg-reconfigure slapd

# インストールの検証
$ ldapsearch -x -LLL -H ldap:/// -b "dc=example,dc=com" "(objectClass=organization)"

# 組織単位の追加（base-ous.ldif）
dn: ou=People,dc=example,dc=com
objectClass: organizationalUnit
ou: People

# ディレクトリに追加
$ ldapadd -x -D "cn=admin,dc=example,dc=com" -W -f base-ous.ldif

# ユーザーエントリの追加
$ ldapadd -x -D "cn=admin,dc=example,dc=com" -W -f user-alice.ldif

# エントリの変更
$ ldapmodify -x -D "cn=admin,dc=example,dc=com" -W -f modify-alice.ldif

# エントリの削除
$ ldapdelete -x -D "cn=admin,dc=example,dc=com" -W "uid=bob,ou=People,dc=example,dc=com"

# すべてのユーザーを検索
$ ldapsearch -x -LLL -b "ou=People,dc=example,dc=com" "(objectClass=posixAccount)" uid cn mail

# 属性で検索
$ ldapsearch -x -LLL -b "dc=example,dc=com" "(uid=alice)"

# ロードされたスキーマの一覧
$ ldapsearch -Q -LLL -Y EXTERNAL -H ldapi:/// 
    -b "cn=schema,cn=config" "(objectClass=olcSchemaConfig)" dn

# 現在の ACL の表示
$ sudo ldapsearch -Q -LLL -Y EXTERNAL -H ldapi:/// 
    -b "olcDatabase={1}mdb,cn=config" olcAccess