Introduction to the Directory Server

etscape's Directory Server is a robust, scalable server designed to manage an enterprise-wide directory of users and resources. Using the Directory Server, corporate IS organizations can manage user information from a single point of control, and employees can retrieve this same information from multiple, easily accessible network locations.

The Directory Server provides a simple interface to the corporate user information. From this interface, you can

You can find more information about searching the directory in Chapter 2, "Searching the directory tree".

If you are managing the data in the directory (for example, adding entries or editing entries), read the rest of this section for background information on how the Directory Server works, then consult one of the following chapters:

Understanding LDAP

Note:

The rest of this section contains information for the directory manager and for users responsible for adding and updating entries in the directory.

The Directory Server is based on an open-systems protocol called the Lightweight Directory Access Protocol (LDAP). Developed in part at the University of Michigan at Ann Arbor, LDAP is a directory service that runs over the network. A directory service is a database application designed to manage descriptive information, such as a person's location or e-mail address.

LDAP directories can be distributed across multiple platforms to increase availability of directory data.

Understanding the hierarchy of data

Data in the directory is arranged in a tree hierarchy. That is, the hierarchy begins at a single point known as the root and branches down to the location of the directory entries.

Because LDAP is intended to be a global directory service, the top of the Directory Server tree is traditionally represented by country name, followed by a series of geographic and physical location information, followed by a common name. For example, a person named Pat Hanson who works in shipping and receiving for A1 Fishing Supplies in the state of Minnesota, US would be located in the directory as the entry:

Country:     US
State:     Minnesota
Organization:     A1 Fishing Supplies
Organizational unit:     Shipping and Receiving
Common name:     Pat Hanson

Further, a different Pat Hanson who works for the same company, but in the accounting department would be uniquely represented in the directory as the entry:

Country:     US
State:     Minnesota
Organization:     A1 Fishing Supplies
Organizational unit:     Accounting
Common name:     Pat Hanson

The following figure illustrates an example of how data is organized in the Directory Server:

Part of the task of adding and maintaining directory information is setting up and organizing the hierarchy of information. Through the Directory Server interface, you can add organizational information to the directory. For example, you can add organizational units for Accounting, Marketing, and Shipping and Receiving.

Before you add new people to the directory, make sure that the hierarchy above the new people is already set up in the directory. For example, make sure that the Accounting organization unit is set up before adding new people to this organization.

As part of the process of setting up this hierarchy of data, you will need to identify the location of each entry in the hierarchy. You identify the location of an entry by using distinguished names.

Understanding distinguished names

The string representing an entry's location in an LDAP directory is known as a distinguished name, or DN. A DN consists of a series of descriptive attributes that uniquely place the entry in the directory. You use DNs to name entries when you add entries to the directory (for example, when you add people to the directory, or when you add members to groups).

A DN can consist of virtually any attributes you wish to use. The only caveat is that the attributes must be recognized as part of the valid schema by the Directory Server, if your directory administrator has turned on schema checking. (If you do not know whether schema checking is turned on in the server, contact your directory administrator, or consult the Netscape Directory Server Administrator's Manual for more information.)

Traditionally, a DN consists of these items in the following order:

This string of identifying attributes uniquely locates the entry within your directory. If you choose, you can also use this naming structure to uniquely identify your entries within the global directory tree as defined in the X.500 standard.

Because a DN represents a path through the directory tree, the DN components are order-dependent. For example, the following DNs do not represent the same entry:

Distinguished name syntax

The traditional syntax for a DN string representation is as follows:

Generally a DN begins with a specific common name, and proceeds with increasingly broader areas of identification until the country name is specified. Note, however, that the actual DN attributes you use, and the order in which you choose to specify them, is up to you and how you want to organize your directory. The only real requirement is that DN attributes must be separated by a comma (,) and can optionally use a space ( ) following the separator.

Distinguished name attributes

The various standard attributes that comprise a DN are as follows:

Attribute Name Definition
c country Identifies the name of the country under which the entry resides. For example:

  • c=US
  • c=GB
cn common name Required attribute that identifies the person or object defined by the entry. For example:

  • cn=Wally Henderson
  • cn=Directory Administrators
  • cn=printer3b
l locality Identifies the locality in which the entry resides. The locality could be a city, county, township, or other geographic region. For example:

  • l=Tucson
  • l=Pacific Northwest
  • l=Anoka County
o organization Identifies the organization in which the entry resides. For example:

  • o=Netscape Communications Corp
  • o=Public Power & Gas
ou organizational unit Identifies a unit within the organization. For example:

  • ou=Sales
  • ou=Manufacturing
st state or province name Identifies the state or province in which the entry resides. For example:

  • st=Iowa
  • st=British Columbia
street street address Identifies the street address at which the entry resides. For example:

  • street=494 Rice Creek Terrace

Distinguished name examples

The following are some examples of distinguished names: