LDAP and Active Directory - directory services fundamentals · Linux

LDAP (Lightweight Directory Access Protocol) is the standard protocol for central directory services. Active Directory (Microsoft) is the most common LDAP deployment in production. This lesson covers how LDAP works and how Linux integrates with it.

The LDAP tree

LDAP entries are arranged in a tree (DIT - Directory Information Tree). Each entry has a Distinguished Name (DN) that uniquely identifies it.

dc=example,dc=com
├── ou=People
│   ├── uid=alice,ou=People,dc=example,dc=com
│   ├── uid=bob,ou=People,dc=example,dc=com
│   └── uid=carol,ou=People,dc=example,dc=com
├── ou=Groups
│   ├── cn=admins,ou=Groups,dc=example,dc=com
│   └── cn=developers,ou=Groups,dc=example,dc=com
└── ou=Computers
    └── cn=server01,ou=Computers,dc=example,dc=com

The top of the tree is the suffix (dc=example,dc=com). Below it are organisational units (ou=People, ou=Groups), then individual entries.

Entry structure

Each entry has a set of attributes. A user entry:

dn: uid=alice,ou=People,dc=example,dc=com
objectClass: inetOrgPerson
uid: alice
cn: Alice Smith
sn: Smith
mail: alice@example.com
uidNumber: 10001
gidNumber: 10001
homeDirectory: /home/alice
loginShell: /bin/bash

The objectClass defines what attributes are allowed. Common classes:

Class	Purpose
`inetOrgPerson`	User
`organizationalUnit`	Container for grouping
`groupOfNames`	Group (with member entries)
`posixAccount`	Unix user attributes (uid, gid, home, shell)
`posixGroup`	Unix group attributes (gid, memberUid)

Active Directory uses different classes (user, group, organizationalUnit) and different attribute names.

Bind and search

To query LDAP:

Bind: authenticate with a DN and password (or anonymously).
Search: query the directory with a filter and base DN.

ldapsearch -H ldap://ldap.example.com \
  -D "cn=admin,dc=example,dc=com" \
  -w <password> \
  -b "ou=People,dc=example,dc=com" \
  "(uid=alice)"

Or with TLS (LDAPS):

ldapsearch -H ldaps://ldap.example.com:636 \
  -D "cn=admin,dc=example,dc=com" \
  -w <password> \
  -b "ou=People,dc=example,dc=com" \
  "(uid=alice)" \
  -ZZ   # require StartTLS

Anonymous bind (for some queries):

ldapsearch -H ldap://ldap.example.com \
  -x \
  -b "dc=example,dc=com" \
  "(objectClass=*)"

Common filters

Filter	Meaning
`(uid=alice)`	User with uid=alice
`(&(objectClass=user)(uid=alice))`	AND
`(\|(uid=alice)(uid=bob))`	OR
`(uid=ali*)`	Wildcard
`(!(uid=alice))`	NOT

Filters are LDAP search filters (RFC 4515), not regex.

Active Directory specifics

AD uses different attribute names and structures:

Concept	OpenLDAP	Active Directory
Base DN	`dc=example,dc=com`	`DC=example,DC=com`
User class	`inetOrgPerson`	`user`
Group class	`groupOfNames`	`group`
uid	`uid`	`sAMAccountName`
Group membership	`member`	`member` (DN) or `memberOf` (DN)
Unix attrs	posixAccount overlay	UNIX attributes tab

AD also adds Kerberos (covered in the next lesson). Most AD integration uses Kerberos for authentication, LDAP for queries.

Linux integration

Linux does not speak LDAP directly for user lookups. It uses an intermediary:

nss_ldap: Direct NSS module for LDAP. Older, less recommended.
sss (SSSD): Modern, with caching and offline support. The right choice for most setups.

# Install SSSD for AD integration
sudo apt install sssd-ad sssd-tools realmd adcli krb5-user

# Discover the AD domain
sudo realm discover example.com

# Join the domain
sudo realm join example.com --user=admin

# Verify
sssctl domain-status example.com
getent passwd alice@EXAMPLE.COM

Common LDAP failure modes

Bind fails: wrong password, locked account, expired password.
Search returns nothing: filter syntax error, wrong base DN, ACL prevents reading.
TLS handshake fails: certificate mismatch, CA bundle missing.
Connection refused: LDAP not running on the server, or firewall blocking.
Slow queries: missing indexes, network latency.