26.0 LDAP—A Directory Service
The Lightweight Directory Access Protocol (LDAP) is a set of protocols
designed to access and maintain information directories. LDAP can be used
for numerous purposes, such as user and group management, system
configuration management, or address management. This chapter provides a
basic understanding of how OpenLDAP works and how to manage LDAP data
with YaST. While there are several implementations of the LDAP
protocol, this chapter focuses entirely on the OpenLDAP implementation.
It is crucial within a networked environment to keep important information
structured and quickly available. This can be done with a directory
service that, like the common yellow pages, keeps information available in
a well-structured, quickly searchable form.
In the ideal case, a central server keeps the data in a directory and
distributes it to all clients using a certain protocol. The data is
structured in a way that allows a wide range of applications to access it.
That way, it is not necessary for every single calendar tool and e-mail
client to keep its own database—a central repository can be accessed
instead. This notably reduces the administration effort for the
information. The use of an open and standardized protocol like LDAP
ensures that as many different client applications as possible can access
such information.
A directory in this context is a type of database optimized for quick and
effective reading and searching:
-
To make numerous concurrent reading accesses possible, the number of
updates is usually very low compared to the number of read accesses and write
access is often limited to a few users with administrative priviledges
only. Conventional databases are optimized for accepting the largest possible
data volume in a short time.
-
When static data is administered, updates of the existing data sets are
very rare. When working with dynamic data, especially when data sets like
bank accounts or accounting are concerned, the consistency of the data is
of primary importance. If an amount should be subtracted from one place to
be added to another, both operations must happen concurrently, within one
transaction, to ensure balance over the data
stock. Traditional relational databases support such transactions. Opposed
to that short-term inconsitancies are usually acceptable in LDAP
directories. LDAP directories often do not have such strong consistancy
requirements as relational databases.
The design of a directory service like LDAP is not laid out to support
complex update or query mechanisms. All applications accessing this
service should gain access quickly and easily.
