CONFIGURING LDAP Authentication (rsso 9.1) RSSO LABS CONFIGURING LDAP Authentication (rsso 9.1)

WHAT IS LDAP? LDAP (Lightweight Directory Access Protocol) is an application protocol to manage and access distributed directory information service over a network. The main purpose of a DS (Directory Service) is to provide an hierarchal structure to access and manage records/data/information, this can include records on computer systems, locations, Organizational unit, and Users As with all hierarchal structured applications LDAP provides the ability to search for a particular record without knowing the full path to the record(s) you are looking for. e.g. AR Server search for computer system CI named “mycomputer” on the CMDB BMC_BaseElement form 'Name' LIKE "%my%" AND 'DatasetId' = "BMC.ASSET“ LDAP search from the root for a user called “JCKER” (&(uid=JCKER))

COMMONLY USED LDAP NAMING ATTRIBUTES CN = Common Name OU = Organizational Unit DC = Domain Component DN: Distinquguised name These are all parts of the X.500 Directory Specification, which defines nodes in a LDAP directory. https://en.wikipedia.org/wiki/X.500 You can also read up on LDAP data Interchange Format (LDIF), which is an alternate format. You read it from right to left, the right-most component is the root of the tree, and the left most component is the node (or leaf) you want to reach. Each = pair is a search criteria. With your example query ("CN=Dev-India,OU=Distribution Groups,DC=gp,DC=gl,DC=google,DC=com"); In effect the query is: From the com Domain Component, find the google Domain Component, and then inside it the gl Domain Component and then inside it the gp Domain Component. In the gp Domain Component, find the Organizational Unit called Distribution Groups and then find the the object that has a common name of Dev-India.

COMMONLY USED LDAP NAMING ATTRIBUTES Common Name: Information in an LDAP database comes in the form of objects. Objects have attributes that describe them. For example, the User object for Allen Allbrook would have attributes such as Allen's logon name, his password, his phone number, his email address, his department, and so forth. When an LDAP client (in our case RSSO) submits a query that contains the objects Distinguihsed Name (DN) and the attributes that the client wants to see. A search for information about Allen could be phrased in a couple of different ways You could search for attributes in Allen's User object. “Give me the Department attribute for cn=Allen Allbrook,cn=Users,dc=Company,dc=com.” You could search for attributes that end up including Allen's object. “Give me all User objects with a Department attribute equal to Support.” In either case, LDAP can find Tom's object because the name assigned to the object describes its place in the LDAP namespace.

LDAP STRUCTURE? The User objects in the diagram have designators that start with CN, meaning Common Name. The CN designator applies to all but a few object types. Active Directory only uses two other object designators (although LDAP defines several). They are as follows: Domain Component (DC). DC objects represent the top of an LDAP tree that uses DNS to define its namespace. Active Directory is an example of such an LDAP tree. The designator for an Active Directory domain with the DNS name Company.com would be dc=Company,dc=com. Organizational Unit (OU). OU objects act as containers that hold other objects. They provide structure to the LDAP namespace. OUs are the only general-purpose container available to administrators in Active Directory. An example OU name would be ou=Accounting. Distinguished Names. A name that includes an object's entire path to the root of the LDAP namespace is called its distinguished name, or DN. An example DN for a user named CSantana whose object is stored in the cn=Users container in a domain named Company.com would be cn=CSantana,cn=Users,dc=Company,dc=com.

WHAT IS LDAP? Common Names: Information in an LDAP database comes in the form of objects. Objects have attributes that describe them. For example, the User object for Allen Allbrook would have attributes such as Allen's logon name, his password, his phone number, his email address, his department, and so forth. When an LDAP client (in our case RSSO) is submits a query that contains the objects Distinguihsed Name (DN) and the attributes that the client wants to see. A search for information about Allen could be phrased in a couple of different ways You could search for attributes in Allen's User object. “Give me the Department attribute for cn=Allen Allbrook,cn=Users,dc=Company,dc=com.” You could search for attributes that end up including Allen's object. “Give me all User objects with a Department attribute equal to Support.” In either case, LDAP can find Tom's object because the name assigned to the object describes its place in the LDAP namespace.