etscape's
Directory Server is a robust, scalable server designed to manage an enterprise-wide
directory of users and resources. Using the Directory Server, corporate
IS organizations can manage user information from a single point of control,
and employees can retrieve this same information from multiple, easily
accessible network locations.
The Directory Server provides a simple interface to the corporate user information. From this interface, you can
You can find more information about searching the directory in Chapter 2, "Searching the directory tree".
If you are managing the data in the directory (for example, adding entries or editing entries), read the rest of this section for background information on how the Directory Server works, then consult one of the following chapters:
Note:
The rest of this section contains information for the directory manager and for users responsible for adding and updating entries in the directory.
The Directory Server is based on an open-systems protocol called the Lightweight Directory Access Protocol (LDAP). Developed in part at the University of Michigan at Ann Arbor, LDAP is a directory service that runs over the network. A directory service is a database application designed to manage descriptive information, such as a person's location or e-mail address.
LDAP directories can be distributed across multiple platforms to increase availability of directory data.
Data in the directory is arranged in a tree hierarchy. That is, the hierarchy begins at a single point known as the root and branches down to the location of the directory entries.
Because LDAP is intended to be a global directory service, the top of the Directory Server tree is traditionally represented by country name, followed by a series of geographic and physical location information, followed by a common name. For example, a person named Pat Hanson who works in shipping and receiving for A1 Fishing Supplies in the state of Minnesota, US would be located in the directory as the entry:
Country: | US | |
State: | Minnesota | |
Organization: | A1 Fishing Supplies | |
Organizational unit: | Shipping and Receiving | |
Common name: | Pat Hanson |
Further, a different Pat Hanson who works for the same company, but in the accounting department would be uniquely represented in the directory as the entry:
Country: | US | |
State: | Minnesota | |
Organization: | A1 Fishing Supplies | |
Organizational unit: | Accounting | |
Common name: | Pat Hanson |
The following figure illustrates an example of how data is organized in the Directory Server:
Part of the task of adding and maintaining directory information is setting up and organizing the hierarchy of information. Through the Directory Server interface, you can add organizational information to the directory. For example, you can add organizational units for Accounting, Marketing, and Shipping and Receiving.
Before you add new people to the directory, make sure that the hierarchy above the new people is already set up in the directory. For example, make sure that the Accounting organization unit is set up before adding new people to this organization.
As part of the process of setting up this hierarchy of data, you will need to identify the location of each entry in the hierarchy. You identify the location of an entry by using distinguished names.
The string representing an entry's location in an LDAP directory is known as a distinguished name, or DN. A DN consists of a series of descriptive attributes that uniquely place the entry in the directory. You use DNs to name entries when you add entries to the directory (for example, when you add people to the directory, or when you add members to groups).
A DN can consist of virtually any attributes you wish to use. The only caveat is that the attributes must be recognized as part of the valid schema by the Directory Server, if your directory administrator has turned on schema checking. (If you do not know whether schema checking is turned on in the server, contact your directory administrator, or consult the Netscape Directory Server Administrator's Manual for more information.)
Traditionally, a DN consists of these items in the following order:
This string of identifying attributes uniquely locates the entry within your directory. If you choose, you can also use this naming structure to uniquely identify your entries within the global directory tree as defined in the X.500 standard.
Because a DN represents a path through the directory tree, the DN components are order-dependent. For example, the following DNs do not represent the same entry:
cn=Ralph Swenson, ou=Accounting, o=Ace Industry, c=US cn=Ralph Swenson, o=Ace Industry, ou=Accounting, c=US
The traditional syntax for a DN string representation is as follows:
cn=common name, [street=address, l=locality, st = state or province, ou=organizational unit, o=organization], c=country name
Generally a DN begins with a specific common name, and proceeds with increasingly broader areas of identification until the country name is specified. Note, however, that the actual DN attributes you use, and the order in which you choose to specify them, is up to you and how you want to organize your directory. The only real requirement is that DN attributes must be separated by a comma (,) and can optionally use a space ( ) following the separator.
The various standard attributes that comprise a DN are as follows:
The following are some examples of distinguished names:
cn=Wally Henderson, ou=Product Development, o=Bait and Tackle Inc, st=Minnesota, c=US
cn=Retch Sweeny, ou=Product Test, o=Bait and Tackle Inc, st=Michigan, c=US
cn=printer3b, l=room 308, o=Acme Programming Ltd, c=US