Basically, a search in LDAP requires a few parameters : + A server on which we will send the request + A port for this server + A base DN, the location where to start the search from A filter to select the entries to be returned + The user doing the search + A password if the user is not already bound + A scope, defining the depth we should look for + The list of attributes to return

Doing a Simple Search on the command line

Here, we see that we are connecting to the sanzibar server, on its 10389 port. As we haven't provided any user, this is an anonymous search, which should be allowed if the server accept anonymous searches. +We then have the base DN, "o=sevenseas", the filter "(cn=James Hook)" and the scope : "sub". The last parameter, "+", asks the server to return all the operational attributes.

The result is just shown as a result of the command (here, we get back one single entry).

Modified: websites/staging/directory/trunk/content/apacheds/basic-ug/2.2.2-more-search-options.html ============================================================================== --- websites/staging/directory/trunk/content/apacheds/basic-ug/2.2.2-more-search-options.html (original) +++ websites/staging/directory/trunk/content/apacheds/basic-ug/2.2.2-more-search-options.html Tue Oct 30 17:53:18 2012 @@ -126,7 +126,87 @@

2.2.2 - More search options

TODO

There are many parameters we haven't explained in the previous chapter.

Bound/anonymous searches

When you send a SearchRequest to the server, you may be anonymous, or you mave have been bound before the search is done. Binding on a server creates an LDAP session, which stores the credentials. This is used by the authorization system to filter the requests and the returned data, depending on the server settings.

Not all the server allow an anonymous search : Apache Dorectory Server default to not enabling such anonymous searches (this is for security questions).

Generally speaking, users do bind before sending a search request.

Filters

The LDAP filters can be quite complex. Although they aren't even close to what SQL provide : there is no way you can do a Join on a LDAP server.

A filter is a set of nodes connected with operators like and, or, not...

Here is the list of possible connectors :

+ + + + + + + + + + + + + + + + + + + + + + + +

Connector	Description	Example
And	All the nodes should be evaluated to true	(&(objectClass=person)(cn=acme))
Or	At least one of the node should be evaluated to true	(\|(objectClass=person)(cn=acme))
Not	select the entries that does not evaluate to true for this filter	(!(objectClass=person))

+ +

Each node proceeds a check on the attributeType and value provided in the filter. For instance, the "(o=sevenseas)" filter tells the server to look for all teh entries whcih have an "organization" atribute with a value of "sevenseas". Here are the various kind of filters you can use :

+ + + + + + + + + + + + + + + + + + + + + + + + + + + +

Filter
= (Equality)
Substring
>=
<=
=* (Present)
~= (ApproxMatch)
extensibleMatch

+ +

Scope

A Search can span across the whole DIT, or just a subset of it. In LDAP, you can use three different scopes :

OBJECT : the Object itself, none of its children
ONELEVEL : all of the base direct children, but not it's children's children not the base object
SUBLEVEL : everything

Returned attributes

A search can also list the attributes to be returned. This can be : + '' for all the user attributes + '+' for all the operational attributes + a list of attributes name +* 1.1 if we don't want the attributes values to be returned, but we want the entries' DN that match the filter

Modified: websites/staging/directory/trunk/content/apacheds/basic-ug/2.3-introducing-schema.html ============================================================================== --- websites/staging/directory/trunk/content/apacheds/basic-ug/2.3-introducing-schema.html (original) +++ websites/staging/directory/trunk/content/apacheds/basic-ug/2.3-introducing-schema.html Tue Oct 30 17:53:18 2012 @@ -126,7 +126,27 @@

2.3 - The Schema

TODO

All the data stored into a LDAP server are structured following a schema, a bit like any DBMS. Apache Directory Server does have a dynamic schema : that means you can modify the schema wihout having to restart the server.

We won't describe in the basic user guide how to manage the schema, this will be extensively described in the Advanced user guide, this chapter is just a short introduction.

What is the LDAP schema ?

It's a set of elements defining the data structure that can be stored in the server. It defines the following elements :

AttributeType : the type of values that can be stored in an attribute
ObjectClass : the set of AttributeType that can or must be used in an entry
Syntax : The syntax the values must abide to
MatchingRule : The rules used to retrieve the data

There are more schema elements which are not currently used in Apache Directory Server.

The following diagram shows all the interactions between each schema element :

How do we use it in ApacheDS ?

The schema is everywhere in the server : each entry is controlled against the schema when it's added or modified. The schema is a critical part of the server.

The Apache Directory Server comes with a predefined schema, which should fit a large part of users need. You may though need to extend it...

Hopefully, the schema can be extended. This will be explained in the Advanced User Guide.

Enough said that you can browse the existing schema using Apache Directory Studio :

then you get the Schema browser :

Added: websites/staging/directory/trunk/content/apacheds/basic-ug/images/open-schema-browser.png ============================================================================== Binary file - no diff available. Propchange: websites/staging/directory/trunk/content/apacheds/basic-ug/images/open-schema-browser.png ------------------------------------------------------------------------------ svn:mime-type = image/png Added: websites/staging/directory/trunk/content/apacheds/basic-ug/images/schema-browser.png ============================================================================== Binary file - no diff available. Propchange: websites/staging/directory/trunk/content/apacheds/basic-ug/images/schema-browser.png ------------------------------------------------------------------------------ svn:mime-type = image/png Added: websites/staging/directory/trunk/content/apacheds/basic-ug/images/schema-objects.png ============================================================================== Binary file - no diff available. Propchange: websites/staging/directory/trunk/content/apacheds/basic-ug/images/schema-objects.png ------------------------------------------------------------------------------ svn:mime-type = image/png Modified: websites/staging/directory/trunk/content/apacheds/basic-users-guide.html ============================================================================== --- websites/staging/directory/trunk/content/apacheds/basic-users-guide.html (original) +++ websites/staging/directory/trunk/content/apacheds/basic-users-guide.html Tue Oct 30 17:53:18 2012 @@ -132,8 +132,6 @@

2.1 - Data modification

2.2 - Searching Data

1 - How to begin

Table of content