network protocols handbook.pdf

25Protocols GuideTCP/IP - Application Layer ProtocolsProtocol NameLDAP: Lightweight DirectoryAccess Protocol (version 3)Protocol DescriptionLightweight Directory Access Protocol (LDAP)is designed toprovide access to the X.500 Directory while not incurring theresource requirements of the Directory Access Protocol (DAP).LDAP is specifically targeted at simple management applicationsand browser applications that provide simple read/writeinteractive access to the X.500 Directory, and is intended to bea complement to the DAP itself.Key aspects of LDAP version 3 are:• All protocol elements of LDAPv2 are supported.• The protocol is carried directly over TCP or other transport,bypassing much of the session/presentation overheadof X.500 DAP.• Most protocol data elements can be encoded as ordinarystrings.• Referrals to other servers may be returned.• SASL mechanisms may be used with LDAP to provideassociation security services.• Attribute values and Distinguished Names have been internationalizedthrough the use of the ISO 10646 characterset.• The protocol can be extended to support new operations,and controls may be used to extend existing operations.• The schema is published in the directory for use by clients.The general model adopted by LDAP is one of clients performingprotocol operations against servers. In this model, a clienttransmits a protocol request to a server, describing the operationto be performed. The server is then responsible for performingthe necessary operation(s) in the directory. Upon completionof the operation(s), the server returns a response, containingany results or errors to the requesting client.In LDAP versions 1 and 2, no provision was made for protocolservers returning referrals to clients. However, for improved performanceand distribution LDAP v3 permits servers to return toclients referrals to other servers. This allows servers to offloadthe work of contacting other servers to progress operations.Protocol StructureLDAP messages are PDUs mapped directly onto the TCP bytestream and use port 389. The LDAP messages do not havetheir own header and are text messages based on ANS.1. Forthe purposes of protocol exchanges, all protocol operationsare encapsulated in a common envelope, the LDAPMessage,The function of the LDAPMessage is to provide an envelopecontaining common fields required in all protocol exchanges. Atthis time, the only common fields are the message ID and thecontrols.Related protocolsTCP, DAPSponsor SourceLDAP is defined by IETF (http://www.ietf.org) in RFC 2251,2252, 2253, 2254, 2255, 2256, 2829, 2830 and 3377.Referencehttp://www.javvin.com/protocol/rfc2251.pdfLightweight Directory Access Protocol (v3) The specification ofthe LDAP on-the-wire protocolhttp://www.javvin.com/protocol/rfc2252.pdfLightweight Directory Access Protocol (v3): Attribute SyntaxDefinitionshttp://www.javvin.com/protocol/rfc2253.pdfLightweight Directory Access Protocol (v3): UTF-8 String Representationof Distinguished Nameshttp://www.javvin.com/protocol/rfc2254.pdfThe String Representation of LDAP Search Filtershttp://www.javvin.com/protocol/rfc2255.pdfThe LDAP URL Formathttp://www.javvin.com/protocol/rfc2256.pdfA Summary of the X.500(96) User Schema for use withLDAPv3http://www.javvin.com/protocol/rfc2829.pdfAuthentication Methods for LDAPhttp://www.javvin.com/protocol/rfc2830.pdfLightweight Directory Access Protocol (v3): Extension for TransportLayer Securityhttp://www.javvin.com/protocol/rfc3377.pdfLightweight Directory Access Protocol (v3): Technical Specification