Hey everyone and welcome back. So in this nugget right here what we're going to do is
we're going to change gear a little bit and we're going to focus on something called LDAP.
Now LDAP is the lightweight directory access protocol and ultimately what this is going
to do is going to provide to us a distributed directory service. Now LDAP is a protocol
that works in Windows. If you've ever heard of something called Active Directory which is very
very common in the enterprise world. Active Directory is going to use heavily the LDAP protocol.
Now specifically for us on Linux we're going to be using something called Open LDAP. This is the
version of LDAP that is going to be operational on our Linux based systems. So really when we're
talking about LDAP we are talking about a directory like structure. So you could imagine
you know the way you can use a phone book back in the day whereby you could look up a business
name and correlate that to say for example a phone number or perhaps an address whatever it may be.
This is a collection of data that is easily searchable and accessible. Ultimately this is what
we're going to be doing here with respect to LDAP. Instead though with LDAP though what we're going to
do is we're going to store information relating to our users and we're going to use this information
about your users to control the authentication process. So really we could have a large organization
with thousands of users all of which their details are going to be known and stored within
the LDAP directory so that when a user tries to log in we consult the LDAP server and the LDAP
server can authenticate this user and not just allow them to log in provide to them the environment
that should be associated with that user i.e. what group do they belong to? Are they in the marketing
department? Are they in the financial department? Maybe they're in the design department so things
like their role in the organization we can also provide the correct home directories that should
be associated with this user. All of this is made possible and at scale using LDAP. Now before we
actually kick off and look at the details here there is some terminology that we absolutely
have to be aware of. The very first thing we want to know is that with respect to LDAP we have
something called an object. Now you can conceptualize an object as a record and this is going to be a
single record within the directory so this could be a particular user account or perhaps a particular
machine on the network maybe a printer. An object is one of the key features of LDAP. Now once we
have established an object such as maybe a user the next term you want to know is the attribute
term. Now all the attribute term relates to are the attributes associated with the objects okay so
we have objects and those objects have particular attributes so if you happen to have a user on
the system maybe their unique identifier would be a particular attribute of that object or if you had
a group object the group ID could be an attribute of that object. Now the way these objects and
attributes happen to be structured and defined this is in accordance with what is called the schema.
So the schema could define the type of objects we could have. We could have say for example a person
and the schema says that this particular object can have particular attributes things like a surname
or things like I say a UID so the UID and the surname would be an attribute of the object but
the actual structure here i.e. that we can have a person and that object will have these particular
attributes is defined in the schema so check this out with respect to our LDAP service this is going
to be structured in a very hierarchical manner going to follow a particular hierarchy. So let's
pretend that I happen to own the domain ipv0.com I don't actually own this but let's just pretend
and let's imagine that ipv0 was a huge huge company within this company we may have an IT department
we may have a finance department and then within the IT department we may have particular users
and the users in that department could be say for example John and Trevor and the finance department
they also may have users of the system so let's maybe say we've got Lauren and Brian now notice
the way that the organization here has a natural hierarchy we all belong to ipv0.com within ipv0
we have particular departments and those departments may have users and they may have particular groups
whatever it may be and within those users we have people like John and people like Trevor and at the
same time we also have another department which acts as a container for different users such as
Lauren and Brian this is ultimately just a hierarchy and this is what we're going to be constructing
when we use our LDAP service so let's use this example again ipv0.com this is the way this is
going to shake out now we're going to talk about a few particular terms here so we're going to have
something called a DC this is a directory container so this could be your domain name or the name of
your database so what we would do is we would take our domain name and we're going to split it up
and at the very end this is going to be our very first directory container so we would have a COM
DC and then within that we would have an ipv0 DC now within here we can go about
constructing many different elements one foundational element of LDAP is something called
an organizational unit now an organizational unit you can conceptualize this as a flexible type of
container flexible in that you can use it for many different things you can use it for organizing
groups or users or admins whatever it may be so in the previous example we had a finance department
and an IT department so we could have a finance organizational unit which would act as a container
for perhaps users and groups and within those users and groups they could also be organizational
units that contain users of that particular department so on so forth so we could then do
so this can be our DC and our DC and let's go with the same example let's say we wanted to
split up our organization into department again this would be a completely arbitrary choice
so let's just say we have a human resources department and a sales department and a marketing
department and again emphasis on the flexibility here and these would all be organizational units
all use all of these here and emphasis again on the flexibility there is nothing particular about
this naming convention it's purely my own design I'm choosing to organize my data in this way via
particular departments so let's say that within these organizational units we just directly started
adding users okay so we could have John and HR department as well as Trevor and then in the
sales department we could have Bob and in the marketing department we could have Nox and Keith
now each of these objects here you would assign particular attributes based on the schema now
whilst we have mentioned the DC the directory container as well as the OU the organizational
unit the next thing I really want to hone in is something called a DN now I know this can be
confusing DCs and DNs and OUs this is again something that just syncs in with a little bit
of familiarity in practice so try not to be overwhelmed here so a DN is called the distinguished
name we really want to be remembering this okay now the distinguished name this is how you're going
to uniquely identify a particular object within the directory now the way the DN is actually
constructed is you effectively just walk your way back up through the hierarchy so say for example
John would have to have a particular attribute such as a UID as per the schema let's say that
would be John's UID we can see here John is part of the organizational unit called HR and we can see
the directory containers which John belongs to is IPv0 so say DC IPv0 and that also is within a DC
called COM so DC COM so all this information here although it might be confusing this all together
is the distinguished name that uniquely identifies this particular object within the directory tree
so really the distinguished name is completely unambiguous it is very explicit and it's meant to
prevent any type of confusion because let's say you maybe have a user of a particular name and also
somewhere else within the directory tree structure we have another group which has the same name we
do not want to have any point of confusion we could still uniquely identify the particular object
by following this tree structure using the distinguished name which will just precisely
point out that exact object now one thing we want to be aware of for the purposes of the examination
and we don't have to see this in any real detail at all is we want to be aware of something called
SSSD what this is is the security system services daemon now the SSSD is what can be used to provide
the actual authentication itself so we really don't have to worry about how this actually works
in the examination we just want to know that LDAP leverages SSSD for the actual authentication going
on here so now that we have a rough idea of what LDAP actually is it is ultimately a directory
tree like structure and we have these particular terms how about we actually dive in to some LDAP
configuration and well that's what we'll be doing in the very next nuggets I hope this has been
informative for you and I'd like to thank you for viewing