A short LDAP Operations tutorial

> The extended LDAP sampler was built to support testing for very complex testpurposes. It was aimed at supporting the LDAP operations as close as possible. In this short tutorial, I will explain which LDAP operations exist and what they do. Per operation, I will shortly explain how these operations are implemented.
> LDAP servers are some kind of hierarchical database, they store objects (entries) in a tree. The uppermost part of a tree is called the ROOT of the tree.
> eg. When a tree starts with dc=com, the root equals dc=com.
> The next level can exist under the root, eg dc=Siemens. The full name of this object (the "distinghuised name") is "dc=siemens,dc=com.
> Again, a following level can be made, by adding the user "cn=admin" under dc=siemens,dc=com. This object has a DN (distinguished name) of "cn=admin,dc=siemens,dc=com".
> The relative distinguished name (RDN) is the last part of the DN, eg. cn=admin.
> The characteristics of an object are determined by the objectClasses, which can be seen as a collection of attributes.
> The type of an object is determined by the "structural objectClass" eg person, organizationalUnit or country.
> The attributes contain the data of an object, eg mailadress, name, streetadress etc. Each attribute can have 0, 1 or more values.

> 1 Bind operation

> > Any contact with an LDAP server MUST start with a bind request. LDAP is a state dependent protocol. Without opening a session to a LDAP server, no additional request can be made. Due to some peculiarities in the JAVA libraries, 2 different bind operations are implemented.

> > 1.1 Thread Bind

> > > This bind is meant to open a session to a LDAP server. Any testplan should use this operation as the starting point from a session. For each Thread (each virtual user) a seperate connection with the LDAP server is build, and so a seperate Thread bind is performed.

> > 1.2 Single bind/unbind

> > > This bind is used for user authentication verification. A proper developed LDAP client, who needs an authenticated user, perform a bind with a given distinguished name and password. This Single bind/unbind operation is for this purpose. It builds it own seperate connection to the LDAP server, performs a bind operation, and ends the connection again (by sending an unbind).

> 2 Unbind

> > To close a connection to a LDAP server, an unbind operation is needed. As the Single bind/unbind operation already (implicitly) performs an unbind, only a Thread unbind operation is needed. This Thread unbind just closes the connection and cleans up any resources it has used.

> 3 Compare

> > The compare operation needs the full distinguished name from a LDAP object, as well as a attribute and a value for the attribute. It will simply check: "Has this object really this attribute with this value?". Typical use is checking the membership of a certain user with a given group.

> 4 Search

> > The search test simply searches for all objects which comply with a given search filter, eg. all persons with a "employeeType=inactive" or "all persons with a userID equals user1"

> 5 Add

> > This simply add an object to the LDAP directory. Off course the combination of attributes and distinguishedName must be valid!

> 6 Modify

> > This operation modifies one or more attributes from a given object. It needs the distinghised name from the object, as well as the attributes and the new values for this attribute.
> > Three versions are available, add, for adding an attribute value
> > replace, for overwriting the old attribute value with a new value
> > delete, to delete a value form an attribute, or to delete all the values of an attribute

> 7 Delete

> > This operation deletes an object from the LDAP server. It needs the distinghised name from the object.

> 8 modDN

> > This operation modifies the distinguished name from an object (it "moves" the object).
> > It comes in two flavours, just renaming an entry, then you specify a new RDN (relative distinguished name, this is the lowest part of the DN)
> > eg, you can rename "cn=admin,dc=siemens,dc=com" to cn=administrator,dc=Siemens,dc=com"
> > The second flavour is renaming (moving) a complete subtree by specifying a "new superior"
> > eg you can move a complete subtree "ou=retired,ou=people,dc=siemens,dc=com" to a new subtree "ou=retired people,dc=siemens,dc=com" by specifying a new rdn "ou=retired people" and a new superior of "dc=siemens,dc=com"

Copyright © 1999-2006, Apache Software Foundation