The LDAP naming model enables directory information to be referenced and organized. Each entry in a directory is uniquely identified by a distinguished name (DN). The DN tells you exactly where an entry resides in the directory hierarchy. A directory information tree (DIT) is used to represent this hierarchy.

Figure 2-1 illustrates the relationship between a distinguished name and a directory information tree.

Figure 2-1 A Directory Information Tree

Description of "Figure 2-1 A Directory Information Tree"

The DIT in Figure 2-1 shows entries for two employees of Example Corporation who are both named Anne Smith. It is structured along geographical and organizational lines. The Anne Smith represented by the left branch works in the Sales division in the United States. Her counterpart works in the Server Development division in the United Kingdom.

The Anne Smith represented by the right branch has the common name (cn) Anne Smith. She works in an organizational unit (ou) named Server Development, in the country (c) of United Kingdom of Great Britain and Northern Ireland (uk), in the organization (o) Example. The DN for this Anne Smith entry looks like this:

cn=Anne Smith,ou=Server Development,c=uk,o=example

Note that the conventional format for a distinguished name places the lowest DIT component at the left. The next highest component follows, on up to the root.

Within a distinguished name, the lowest component is called the relative distinguished name (RDN). In the DN just presented, the RDN is cn=Anne Smith. The RDN for the entry immediately above Anne Smith's RDN is ou=Server Development. And the RDN for the entry immediately above ou=Server Development is c=uk, and so on. A DN is thus a sequence of RDNs separated by commas.

To locate a particular entry within the overall DIT, a client uniquely identifies that entry by using the full DN—not simply the RDN—of that entry. To avoid confusion between the two Anne Smiths in the global organization depicted in Figure 2-1, you use the full DN for each. If there are two employees with the same name in the same organizational unit, you can use other mechanisms. You may, for example, use a unique identification number to identify these employees.

The LDAP information model determines the form and character of information in the directory. This model uses the concept of entries as its defining characteristic. In a directory, an entry is a collection of information about an object. A telephone directory, for example, contains entries for people. A library card catalog contains entries for books. An online directory may contain entries for employees, conference rooms, e-commerce partners, or shared network resources such as printers.

In a typical telephone directory, a person entry contains an address and a phone number. In an online directory, each of these pieces of information is called an attribute. A typical employee entry contains attributes for a job title, an e-mail address, and a phone number.

In Figure 2-2, the entry for Anne Smith in Great Britain (uk) has several attributes. Each provides specific information about her. Those listed in the balloon to the right of the tree are emailaddrs, printername, jpegPhoto, and app preferences. Note that the rest of the bullets in Figure 2-2 are also entries with attributes, although these attributes are not shown.

Figure 2-2 Attributes of the Entry for Anne Smith

Description of "Figure 2-2 Attributes of the Entry for Anne Smith"

Each attribute consists of an attribute type and one or more attribute values. The attribute type is the kind of information that the attribute contains—jobTitle, for instance. The attribute value is the actual information. The value for the jobTitle attribute, for example, might be manager.

The LDAP functional model determines what operations can be performed on directory entries. There operations are mainly search, modify and authenticate.

The LDAP security model enables directory information to be secured. It ensures the data security and integrity in Oracle Internet Directory.

This model has several parts as described in the following sections:

• Understanding Authentication Types in Oracle Internet Directory

• Understanding Access Control and Authorization in Oracle Internet Directory

• Understanding Data Integrity in Oracle Internet Directory

• Understanding Data Privacy in Oracle Internet Directory

• Understanding Password Policies in Oracle Internet Directory

Typically, to invoke the LDAP API, you need to initialize and authenticate the session.

An application uses the functions in the API in four steps:

1. Initialize the library and obtain an LDAP session handle.

2. Authenticate to the LDAP server if necessary.

3. Perform some LDAP operations and obtain results and errors, if any.

4. Close the session.

Figure 2-3 illustrates these steps.

Figure 2-3 Steps in Typical DBMS_LDAP Usage

Description of "Figure 2-3 Steps in Typical DBMS_LDAP Usage"

When you build applications with the C API, you must include the header file ldap.h, located at $ORACLE_HOME/ldap/public.

The DBMS_LDAP package enables PL/SQL applications to access data located in enterprise-wide LDAP servers. The names and syntax of the function calls are similar to those of the C API.

1. Log in to the database, using SQL*Plus. Run the tool in the Oracle home in which your database is present. Connect as SYSDBA.

   SQL> CONNECT / AS SYSDBA
   

2. Load the API into the database, using this command:

   SQL> @?/rdbms/admin/catladap.sql

Java developers can use the Java Naming and Directory Interface (JNDI) to gain access to information in Oracle Internet Directory.

http://www.oracle.com/technetwork/java/jndi/index.html

The C function ldap_init() initializes a session with an LDAP server. The server is not actually contacted until an operation is performed that requires it, allowing options to be set after initialization.

LDAP *ldap_init
(

const char      *hostname,
int             portno

);

hostname

portno

In the PL/SQL API, the function DBMS_LDAP.init() initiates an LDAP session.

FUNCTION init (hostname IN VARCHAR2, portnum  IN PLS_INTEGER )

RETURN SESSION;

The oracle.ldap.util.jndi package supports basic connections by providing wrapper methods for the JNDI implementation.

http://www.oracle.com/technetwork/java/jndi/index.html

import oracle.ldap.util.jndi
import javax.naming.*;

public static void main(String args[])
{
  try{
       InitialDirContext ctx = ConnectionUtil.getDefaultDirCtx(args[0], // host
                                                         args[1],  // port
                                                         args[2],  // DN
                                                         args[3];  // password)
       // Do work
     }
  catch(NamingException ne)
  {
    // javax.naming.NamingException is thrown when an error occurs
  }
}

The C function ldap_simple_bind_s() enables users and applications to authenticate to the directory server using a DN and password.

int ldap_simple_bind_s
(
LDAP* ld,
char* dn,
char* passwd
);

ld

dn

passwd 

The PL/SQL function simple_bind_s enables users and applications to use a DN and password to authenticate to the directory.

FUNCTION simple_bind_s ( d IN SESSION, dn IN VARCHAR2, passwd IN VARCHAR2)

RETURN PLS_INTEGER;

DECLARE

retval	PLS_INTEGER;
my_session	DBMS_LDAP.session;

BEGIN

retval	:= -1;
-- Initialize the LDAP session
my_session	:= DBMS_LDAP.init('yow.example.com',3060);
--Authenticate to the directory
retval	:=DBMS_LDAP.simple_bind_s(my_session,'cn=orcladmin',  	'welcome');

A typical search operation results in exact information when given proper attributes.

The programming required to initiate a typical search operation and retrieve results can be broken down into the following steps:

1. Decide what attributes must be returned; then place them into an array.

2. Initiate the search, using the scope options and filters of your choice.

3. Obtain an entry from result set.

4. Obtain an attribute from the entry obtained in step 3.

5. Obtain the values of the attributes obtained in step 4; then copy these values into local variables.

6. Repeat step 4 until all attributes of the entry are examined.

7. Repeat Step 3 until there are no more entries

Figure 2-4 uses a flowchart to represent these steps.

Figure 2-4 Flow of Search-Related Operations

Description of "Figure 2-4 Flow of Search-Related Operations"

The scope of a search determines how many entries the directory server examines relative to the search base.

SCOPE_BASE

SCOPE_ONELEVEL

SCOPE_SUBTREE

Figure 2-5 The Three Scope Options

Description of "Figure 2-5 The Three Scope Options"

In Figure 2-5, the search base is the shaded circle. The shaded rectangle identifies the entries that are searched.

A search filter is an expression that enables you to confine your search to certain types of entries. The search filter required by the search_s() and search_st() functions follows the string format defined in RFC 1960 of the Internet Engineering Task Force (IETF).

(att=value)

(sn=Keaton)

(att~=value)

(sn~=Ketan)

(attr=[leading]*[any]*[trailing]

(sn=*keaton*)

(sn=keaton*)

(sn=*keaton)

(sn=ke*at*on)

attr>=value

(sn>=Keaton)

(attr<=value)

(sn<=Keaton)

(attr=*)

(sn=*)

attr[:dn]:=value

(sn:dn:=Mary Smith)

(&(filter1)(filter2)). . .)

(&(sn=keaton)(objectclass=inetOrgPerson))

(|(filter1)(filter2)). . .)

(|(sn~=ketan)(cn=*keaton))

(!(filter))

(!(mail=*))

The C function ldap_search_s() performs a synchronous search of the directory.

int ldap_search_s
(
LDAP*         ld,
char*         base,
int           scope,
char*         filter
int           attrsonly,
LDAPMessage** res
);

ld

base

scope

filter

attrs

attrso

res

1. Decide what attributes must be returned; then place them into an array of strings. The array must be null terminated.
2. Initiate the search, using ldap_search_s(). Refine your search with scope options and filters.
3. Obtain an entry from the result set, using either the ldap_first_entry() function or the ldap_next_entry() function.
4. Obtain an attribute from the entry obtained in step 3. Use either the ldap_first_attribute() function or the ldap_next_attribute() function for this purpose.
5. Obtain all the values for the attribute obtained in step 4; then copy these values into local variables. Use the ldap_get_values() function or the ldap_get_values_len() function for this purpose.
6. Repeat step 4 until all attributes of the entry are examined.
7. Repeat step 3 until there are no more entries.

You use the function DBMS_LDAP.search_s()to perform directory searches if you use the PL/SQL API.

FUNCTION search_s

(
ld       IN  SESSION,
base     IN  VARCHAR2,
scope    IN  PLS_INTEGER,
filter   IN  VARCHAR2,
attrs    IN  STRING_COLLECTION,
attronly IN  PLS_INTEGER,
res      OUT MESSAGE
)

RETURN PLS_INTEGER;

ld

base

scope

filter

attrs

attronly

res

1. Decide what attributes need to be returned; then place them into the DBMS_LDAP.STRING_COLLECTION data-type.
2. Perform the search, using either DBMS_LDAP.search_s()or DBMS_LDAP.search_st(). Refine your search with scope options and filters.
3. Obtain an entry from the result set, using eitherDBMS_LDAP.first_entry() or DBMS_LDAP.next_entry().
4. Obtain an attribute from the entry obtained in step 3. Use either DBMS_LDAP.first_attribute() or DBMS_LDAP.next_attribute() for this purpose.
5. Obtain all the values for the attribute obtained in step 4; then copy these values into local variables. Use either DBMS_LDAP.get_values() or DBMS_LDAP.get_values_len() for this purpose.
6. Repeat step 4 until all attributes of the entry are examined.
7. Repeat step 3 until there are no more entries.

After an LDAP session handle is obtained and all directory-related work is complete, the LDAP session must be destroyed. In the C API, the ldap_unbind_s() function is used for this purpose.

int ldap_unbind_s
(
	LDAP* 	ld
);

The DBMS_LDAP.unbind_s() function destroys an LDAP session if the PL/SQL API is used.

FUNCTION unbind_s (ld IN SESSION )  RETURN PLS_INTEGER;