PDF p.103
In progress
Directory Services
Summary
PDF p.103Directory services store information about users, computers, security groups/roles, and services. They use a schema to define attributes and are often based on the Lightweight Directory Access Protocol (LDAP), derived from the X.500 standard. Distinguished names (DNs) uniquely identify resources within the directory.
In plain words
Supplementary — not from your PDFA directory service is the central phonebook of users, computers and groups. Most speak LDAP, and each object has a distinguished name (DN) built from parts like CN, OU, O, C and DC.
Detailed explanation
PDF p.103-
Directory Service
- Function: Stores information about various objects (users, computers, etc.).
- Attributes: Each object has attributes defined by the directory schema, which specifies the type of information and whether it is required or optional.
- Interoperability: Most directory services use LDAP to ensure compatibility across different vendors.
-
Distinguished Name (DN)
- Definition: A unique identifier for resources within an X.500-like directory.
- Structure: Composed of attribute-value pairs, separated by commas.
- Relative Distinguished Name: The most specific attribute, uniquely identifying the object within the context of broader attributes.
-
Common Attributes
- CN (Common Name): Identifies the specific object.
- OU (Organizational Unit): Represents a subdivision within an organization.
- O (Organization): The name of the organization.
- C (Country): The country code.
- DC (Domain Component): Components of the domain name.
-
Example
- Distinguished Name: CN=WIDGETWEB, OU=Marketing, O=Widget, C=UK, DC=widget, DC=foo
- Explanation: This DN identifies a web server operated by Widget in the UK, within the Marketing organizational unit.
Important terms
taken from the text above- Interoperability
- Most directory services use LDAP to ensure compatibility across different vendors.
- Distinguished Name (DN)
- A unique identifier for resources within an X.500-like directory.
- Relative Distinguished Name
- The most specific attribute, uniquely identifying the object within the context of broader attributes.
- CN (Common Name)
- Identifies the specific object.
- OU (Organizational Unit)
- Represents a subdivision within an organization.
- O (Organization)
- The name of the organization.
- C (Country)
- The country code.
- DC (Domain Component)
- Components of the domain name.
- Distinguished Name
- CN=WIDGETWEB, OU=Marketing, O=Widget, C=UK, DC=widget, DC=foo
- Explanation
- This DN identifies a web server operated by Widget in the UK, within the Marketing organizational unit.
LDAP Lightweight Directory Access Protocol
DNs Distinguished names
DN Distinguished Name
Examples & real-world scenarios
Supplementary — not from your PDF- Active Directory storing all company accounts.
- DN: CN=WIDGETWEB, OU=Marketing, O=Widget, C=UK, DC=widget, DC=foo.
- The schema defining which attributes each object can have.
Scenario
An app needs to check whether a user belongs to the 'Finance' group. It queries the directory over LDAP (ideally LDAPS) instead of keeping its own user list.
Common mistakes
Supplementary — not from your PDF- Mixing up the certificate CN (Common Name) and the directory DN. They're related naming ideas, used differently.
- Forgetting that plain LDAP isn't encrypted.
Practical skills
Supplementary — not from your PDF- Read the parts of a distinguished name.
What I should remember
Key Points PDF p.103-
Directory Service
- Stores Information: About users, computers, roles, and services.
- Schema: Defines attributes and their requirements.
- LDAP: Ensures vendor interoperability.
-
Distinguished Name (DN)
- Unique Identifier: For resources.
- Structure: Attribute-value pairs.
- Relative Distinguished Name: Most specific attribute.
-
Common Attributes
- CN: Common Name.
- OU: Organizational Unit.
- O: Organization.
- C: Country.
- DC: Domain Component.
-
Example
- DN: CN=WIDGETWEB, OU=Marketing, O=Widget, C=UK, DC=widget, DC=foo