TCP/IP Tutorial and Technical Overview - IBM Redbooks

together in some way in order to form a distributed directory that contains the
entire DIT. This is accomplished with referrals. A referral acts as a pointer to an
entry on another LDAP server where requested information is stored. A referral is
an entry of objectClass referral. It has an attribute, ref, whose value is the LDAP
URL of the referred entry on another LDAP server. See 12.4.6, “LDAP URLs” on
page 474 for further information. Referrals allow a DIT to be partitioned and
distributed across multiple servers. Portions of the DIT can also be replicated.
This can improve performance and availability.
Note: When an application uses LDAP to request directory information from a
server, but the server only has a referral for that information, the LDAP URL
for that information is passed to the client. It is then the responsibility of that
client to contact the new server to obtain the information. This is unlike the
standard mechanisms of both DCE and X.500, where a directory server, if it
does not contain the requested information locally, will always obtain the
information from another server and pass it back to the client.
The functional model
LDAP defines operations for accessing and modifying directory entries. LDAP
operations can be divided into the following three categories:
Query Includes the search and compare operations used to
retrieve information from a directory.
Update Includes the add, delete, modify, modify RDN, and
unsolicited notification operations used to update stored
information in a directory. These operations will normally
be carried out by an administrator.
Authentication Includes the bind, unbind, abandon, and startTLS
operations used to connect and disconnect to and from an
LDAP server, establish access rights, and protect
information. For further information, see 12.4.5, “LDAP
security” on page 471.
The search operation
The most common operation is the search. This operation is very flexible and
therefore has some of the most complex options. The search operation allows a
client to request that an LDAP server search through some portion of the DIT for
information meeting user-specified criteria in order to read and list the results.
The search can be very general or very specific. The search operation allows the
specification of the starting point within the DIT, how deep within the DIT to
search, the attributes an entry must have to be considered a match, and the
attributes to return for matched entries.
Chapter 12. Directory and naming protocols 469