Understanding LDAP Search Queries: A Guide to CN, OU, and DC

LDAP (Lightweight Directory Access Protocol) is a protocol used for accessing and managing directory information services. It provides a standardized way of organizing and retrieving data from a hierarchical structure called the Directory Information Tree (DIT). In this tutorial, we will explore the basics of LDAP search queries, focusing on the CN, OU, and DC components.

Introduction to LDAP Components

LDAP uses a set of attributes to identify entries in the directory. The most common attributes are:

• CN: Common Name – a unique name for an object.
• OU: Organizational Unit – a container that holds other objects.
• DC: Domain Component – a part of the domain name.

These attributes are used to construct a Distinguished Name (DN), which uniquely identifies an entry in the directory. The DN is a series of comma-separated key-value pairs, with each pair representing an attribute and its value.

Reading LDAP Search Queries

LDAP search queries are read from right to left, starting with the root of the tree (the domain component) and moving down to the leaf node (the common name). Each attribute-value pair in the query represents a search criterion.

For example, consider the following LDAP search query:

CN=Dev-India,OU=Distribution Groups,DC=gp,DC=gl,DC=google,DC=com

This query can be broken down as follows:

1. Start with the domain component com.
2. Find the domain component google within com.
3. Within google, find the domain component gl.
4. Within gl, find the domain component gp.
5. Within gp, find the organizational unit Distribution Groups.
6. Within Distribution Groups, find the object with common name Dev-India.

Constructing LDAP Search Queries

To construct an LDAP search query, you need to know the DN of the entry you want to retrieve or the attributes and values that identify the entry. You can use a combination of attribute-value pairs to narrow down the search.

For example:

CN=Diana Anton,OU=People,DC=gp,DC=gl,DC=google,DC=com

This query retrieves the entry with common name Diana Anton within the organizational unit People, which is located in the domain component gp, and so on.

Searching for Entries

LDAP provides two ways to search for entries:

1. Exact match: Specify the entire DN of the entry you want to retrieve.
2. Attribute-value pair matching: Specify one or more attribute-value pairs that identify the entry.

For example:

(distinguishedName=CN=Dev-India,OU=Distribution Groups,DC=gp,DC=gl,DC=google,DC=com)

This query retrieves the entry with the specified distinguished name.

Conclusion

In this tutorial, we covered the basics of LDAP search queries, including the CN, OU, and DC components. We learned how to read and construct LDAP search queries, as well as how to search for entries using exact matches or attribute-value pair matching. By understanding these concepts, you can effectively use LDAP to retrieve and manage directory information.

Example Use Cases

• Retrieving a user’s email address from an LDAP directory.
• Searching for all employees in a specific department.
• Authenticating users against an LDAP directory.

By applying the knowledge gained from this tutorial, you can create efficient and effective LDAP search queries to meet your needs.