几种常见的LDAP系统

Technically, LDAP is a directory access protocol to an X.500 directory service, the OSI directory service. 
Initially, LDAP clients accessed gateways to the X.5h0 directory service. 
This gateway ran LDAP between the client and gateway and X.500's Directory Access Protocol (DAP) between the gateway and the X.500 server.
DAP is a heavyweight protocol that operates over a full OSI protocol stack and requires a significant amount of computing resources. 
LDAP is designed to operate over TCP/IP and provides most of the functionality of DAP at a much lower cost.

dn: dc=idevelopment,dc=info
dc: idevelopment
o: iDevelopment.info LDAP Server
description: Root entry for iDevelopment.info. 
 iDevelopment.info is a public website that provides a professional forum to exchange 
 information, ideas, and expertise on advanced topics in the IT and scientific fields. 
 The audience for iDevelopment.info includes Database Administrators, System Administrators, 
 Developers, Computer Scientists, Software Engineers, and Mathematicians.
objectClass: top
objectclass: dcObject
objectclass: organization

dn: ou=People,dc=idevelopment,dc=info
ou: People
description: All people in iDevelopment.info
objectClass: top
objectClass: organizationalUnit

dn: cn=Manager,dc=idevelopment,dc=info
cn: Manager
description: Rootdn
objectclass: organizationalRole

dn: uid=usuario1,dc=ldap-kike,dc=com,dc=uy                 //DN
uid: usuario1
cn: usuario1
objectClass: account                                       //直接应用的objectClass
objectClass: posixAccount
objectClass: top
objectClass: shadowAccount
userPassword: {crypt}$1$TEDFGNB3$m24Mo06Q06EXMop7INKrC/    //其它属性
shadowLastChange: 14335
shadowMax: 99999
shadowWarning: 7
loginShell: /bin/bash
uidNumber: 10000
gidNumber: 10000
homeDirectory: /home/usuario1
gecos: usuario1

    LDAPMessage ::= SEQUENCE {
         messageID       MessageID,
         protocolOp      CHOICE {
              bindRequest           BindRequest,
              bindResponse          BindResponse,
              unbindRequest         UnbindRequest,
              searchRequest         SearchRequest,
              searchResEntry        SearchResultEntry,
              searchResDone         SearchResultDone,
              searchResRef          SearchResultReference,
              modifyRequest         ModifyRequest,
              modifyResponse        ModifyResponse,
              addRequest            AddRequest,
              addResponse           AddResponse,
              delRequest            DelRequest,
              delResponse           DelResponse,
              modDNRequest          ModifyDNRequest,
              modDNResponse         ModifyDNResponse,
              compareRequest        CompareRequest,
              compareResponse       CompareResponse,
              abandonRequest        AbandonRequest,
              extendedReq           ExtendedRequest,
              extendedResp          ExtendedResponse,
              ...,
              intermediateResponse  IntermediateResponse },
         controls       [0] Controls OPTIONAL }

    MessageID ::= INTEGER (0 ..  maxInt)

    maxInt INTEGER ::= 2147483647 -- (2^^31 - 1) 

认证
allow authentication information to be exchanged between the client and server

clients may send multiple Bind requests 
to change the authentication and/or security associations or 
to complete a multi-stage Bind process

The serverSaslCreds field is used as part of a SASL-defined bind
mechanism to allow the client to authenticate the server to which it
is communicating, or to perform "challenge-response" authentication.

to terminate an LDAP session

The Search operation is used to request a server to return, subject
to access controls and other restrictions, a set of entries matching
a complex search criterion.  

This can be used to read attributes from
a single entry, from entries immediately subordinate to a particular
entry, or from a whole subtree of entries.

allows a client to request that a modification
of an entry be performed on its behalf by a server.

allows a client to request the addition of an entry into the Directory

allows a client to request the removal of an entry from the Directory.

allows a client to change the Relative Distinguished Name (RDN) of 
an entry in the Directory and/or to move a subtree of entries to a 
new location in the Directory.

allows a client to compare an assertion value with the values of a
particular attribute in a particular entry in the Directory.

slapd - stand-alone LDAP daemon (server)
libraries implementing the LDAP protocol, and
utilities, tools, and sample clients. 

CentOS Linux release 7.3.1611 (Core)
openldap-clients-2.4.40-13.el7.x86_64
openldap-servers-2.4.40-13.el7.x86_64
openldap-2.4.40-13.el7.x86_64

yum install -y openldap-servers

$rpm -ql openldap-servers
/etc/openldap/check_password.conf               <-- 配置文件
/etc/openldap/schema
/etc/openldap/schema/collective.ldif
...省略...
/etc/openldap/slapd.conf
/etc/openldap/slapd.conf.bak
/etc/openldap/slapd.d
/etc/sysconfig/slapd
/usr/lib/systemd/system/slapd.service           <-- 系统服务
/usr/lib/tmpfiles.d/slapd.conf
/usr/lib64/openldap/accesslog-2.4.so.2
...省略...
/usr/libexec/openldap/check-config.sh
/usr/libexec/openldap/convert-config.sh
/usr/libexec/openldap/functions
/usr/libexec/openldap/generate-server-cert.sh
/usr/libexec/openldap/upgrade-db.sh
/usr/sbin/slapacl                               <-- 可以使用的一些命令
/usr/sbin/slapadd
/usr/sbin/slapauth
/usr/sbin/slapcat
/usr/sbin/slapd
/usr/sbin/slapdn
/usr/sbin/slapindex
/usr/sbin/slappasswd
/usr/sbin/slapschema
/usr/sbin/slaptest
/usr/share/doc/openldap-servers-2.4.40          <-- 文档
...省略...
/var/lib/ldap
/var/run/openldap

systemct start slapd

yum install -y openldap-clients

$rpm -ql  openldap-clients
/usr/bin/ldapadd
/usr/bin/ldapcompare
/usr/bin/ldapdelete
/usr/bin/ldapexop
/usr/bin/ldapmodify
/usr/bin/ldapmodrdn
/usr/bin/ldappasswd
/usr/bin/ldapsearch
/usr/bin/ldapurl
/usr/bin/ldapwhoami
/usr/share/man/man1/ldapadd.1.gz
...省略...

// -b: 从这个base开始搜索
// -s: 搜索范围，[base|one|sub|children]
// '(objectclass=*)':  搜索条件search filter
// namingContexts:  查找的属性名

ldapsearch -x -b '' -s base '(objectclass=*)' namingContexts

dn: dc=my-domain,dc=com
objectclass: dcObject
objectclass: organization
o: Example Company
dc: my-domain

dn: cn=Manager,dc=my-domain,dc=com
objectclass: organizationalRole
cn: Manager

ldapadd -x -D "cn=Manager,dc=mydomain,dc=com" -W -f manger.ldif