1. LDAP: Accessing Operational Information CNS 4650 Fall 2004 Rev. 2

2. Server Information Allows developer/admin to not have to make assumptions about directory Often termed the “root object” or root DSE (p.174) Server is required to recognize the the attributes Server is NOT required to have the attributes or values in those attributes

3. Root DSE attributes altServer Other servers that can be contacted if this server is unavailable namingContexts List of naming contexts held by the LDAP server supportedControl List of the OIDs of controls the LDAP server supports supportedExtension List of the OIDs of the extensions the LDAP server supports

4. Root DSE attributes supportedLDAPVersion Lists LDAP version supported supportedSASLMechanisms Lists the SASL mechanisms supported by the LDAP server Can also have custom (vendor specific) attributes supportedFeature (OpenLDAP)

5. OpenLDAP Controls From the ldap.h file: /* LDAP Controls */ #define LDAP_CONTROL_MANAGEDSAIT"2.16.840.1.113730.3.4.2" #define LDAP_CONTROL_NOOP"1.3.6.1.4.1.4203.1.10.2" #define LDAP_CONTROL_SORTREQUEST "1.2.840.113556.1.4.473" #define LDAP_CONTROL_SORTRESPONSE"1.2.840.113556.1.4.474" #define LDAP_CONTROL_VLVREQUEST "2.16.840.1.113730.3.4.9" #define LDAP_CONTROL_VLVRESPONSE "2.16.840.1.113730.3.4.10" #define LDAP_CONTROL_VALUESRETURNFILTER "1.2.826.0.1.334810.2.3"

6. OpenLDAP Extensions From the ldap.h file: #define LDAP_EXOP_START_TLS"1.3.6.1.4.1.1466.20037" #define LDAP_EXOP_MODIFY_PASSWD"1.3.6.1.4.1.4203.1.11.1" #define LDAP_TAG_EXOP_MODIFY_PASSWD_ID((ber_tag_t) 0x80U) #define LDAP_TAG_EXOP_MODIFY_PASSWD_OLD((ber_tag_t) 0x81U) #define LDAP_TAG_EXOP_MODIFY_PASSWD_NEW((ber_tag_t) 0x82U) #define LDAP_TAG_EXOP_MODIFY_PASSWD_GEN((ber_tag_t) 0x80U) #define LDAP_EXOP_X_WHO_AM_I"1.3.6.1.4.1.4203.1.11.3"

7. How to Query for Operational Information Set the search base to “” Set scope to “base” Set the search filter to: ‘(objectclass=*)’ Query for certain attributes: namingContexts Query for all attributes “+” (RFC 3673)

8. Example Query ldapsearch -h 161.28.116.244 -b "" -s base -x -W '(objectclass=*)' "+"

9. Subschema Contains the schema definitions No standard place That is what the operational attributes are used for! Query the root DSE for “subschemasubentry” OpenLDAP - cn=Subschema eDirectory/Active Directory - cn=schema

10. Subschema The subschema contains all objectclasses and attributes the server supports Developer/Admin could query and search for objectclass or attribute Example: inetOrgPerson

11. Subschema Search Objectclasses ldapsearch -h 161.28.116.244 -b "cn=Subschema" -s base -x -W '(objectclass=*)' attributetypes Attributes ldapsearch -h 161.28.116.244 -b "cn=Subschema" -s base -x -W '(objectclass=*)' attributetypes Combination of Both ldapsearch -h 161.28.116.244 -b "cn=Subschema" -s base -x -W '(objectclass=*)' objectclassses attributetypes

12. Subschema Search Matching Rules ldapsearch -h 161.28.116.244 -b "cn=Subschema" -s base -x -W '(objectclass=*)' matchingRules LDAP Syntaxes ldapsearch -h 161.28.116.244 -b "cn=Subschema" -s base -x -W '(objectclass=*)' ldapSyntaxes Ask for it all ldapsearch -h 161.28.116.244 -b "cn=Subschema" -s base -x -W '(objectclass=*)' subschema

13. Monitor Used to store other server information in the entry Server version (not LDAP but release) Total connections Startup time Bytes sent Information different from root DSE This entry is more on the running condition, network information, etc.

14. Monitor Usually can be queried by: Base = “cn=Monitor” Scope = “base” Filter = ‘(objectclass=*)’ But DN can differ from server to server Best to query root DSE and return “monitor” For OpenLDAP it must be specified at compile time