TCP/IP Tutorial and Technical Overview - IBM Redbooks

12.4.4 LDAP models
distinguished names. This tree of directory entries is called the directory
information tree (DIT).
LDAP defines operations for accessing and modifying directory entries, such as:
► Searching for entries meeting user-specified criteria
► Adding an entry
► Deleting an entry
► Modifying an entry
► Modifying the distinguished name or relative distinguished name of an entry
(move)
► Comparing an entry
LDAP can be better understood by considering the four models upon which it is
based:
Information Describes the structure of information stored in an LDAP
directory.
Naming Describes how information in an LDAP directory is organized
and identified.
Functional Describes the operations that can be performed on the
information stored in an LDAP directory.
Security Describes how the information in an LDAP directory can be
protected from unauthorized access.
The following sections discuss the first three LDAP models. We describe LDAP
security in 12.4.5, “LDAP security” on page 471.
The information model
The basic unit of information stored in the directory is an entry, which represents
an object of interest in the real world such as a person, server, or organization.
Each entry contains one or more attributes that describe the entry. Each attribute
has a type and one or more values. For example, the directory entry for a person
might have an attribute called telephoneNumber. The syntax of the
telephoneNumber attribute specifies that a telephone number must be a string of
numbers that can contain spaces and hyphens. The value of the attribute is the
person's telephone number, such as 123-456-7890 (a person might have
multiple telephone numbers, in which case this attribute would have multiple
values).
464 TCP/IP Tutorial and Technical Overview