Download the JDK
Search the Tutorials
Hide the TOC
Trail: Java Naming and Directory Interface(TM).
Lesson: Advanced Topics for LDAP Users
Advanced Topics for LDAP Users
LDAP v3
JNDI as an LDAP API
How LDAP Operations Map to JNDI APIs
How LDAP Error Codes Map to JNDI Exceptions
Security
Modes of Authenticating to LDAP
Authentication Mechanisms
Anonymous
Simple
SASL
Digest-MD5
SSL and Custom Sockets
More LDAP Operations
LDAP Compare
Search Results
LDAP Unsolicited Notifications
Connection Management
Creation
Closing
Pooling
Configuration
Frequently Asked Questions
Home Page > Java Naming and Directory Interface(TM). > Advanced Topics for LDAP Users
JNDI as an LDAP API

> Both the JNDI and LDAP models define a hierarchical namespace in which you name objects. Each object in the namespace may have attributes that can be used to search for the object. At this high level, the two models are similar, so it is not surprising that the JNDI maps well to the LDAP.

> #### Models

> You can think of an LDAP entry as a JNDI `DirContext`. Each LDAP entry contains a name and a set of attributes, as well as an optional set of child entries. For example, the LDAP entry `"o=JNDITutorial"` may have as its attributes `"objectclass"` and `"o"`, and it may have as its children `"ou=Groups"` and `"ou=People"`.

> In the JNDI, the LDAP entry `"o=JNDITutorial"` is represented as a context with the name `"o=JNDITutorial"` that has two subcontexts, named: `"ou=Groups"` and `"ou=People"`. An LDAP entry's attributes are represented by the `Attributes` interface, whereas individual attributes are represented by the `Attribute` interface.

> See the next part of this lesson for details on how the LDAP operations are accessed through the JNDI.

> #### Names

> As a result of federation, the names that you supply to the JNDI's context methods can span multiple namespaces. These are called composite names. When using the JNDI to access an LDAP service, you should be aware that the forward slash character ("/") in a string name has special meaning to the JNDI. If the LDAP entry's name contains this character, then you need to escape it (using the backslash character ("\")). For example, an LDAP entry with the name `"cn=O/R"` must be presented as the string `"cn=O\\/R"` to the JNDI context methods. For more information about Names check out the JNDI Tutorial . The LdapName and Rdn classes simplify creation and manipulation of LDAP names.

> LDAP names as they are used in the protocol are always fully qualified names that identify entries that start from the root of the LDAP namespace (as defined by the server). Following are some examples of fully qualified LDAP names.

> >     cn=John Smith, ou=Marketing, o=Some Corporation, c=gb
> >     cn=Vinnie Ryan, ou=People, o=JNDITutorial

> In the JNDI, however, names are always relative; that is, you always name an object relative to a context. For example, you can name the entry `"cn=Vinnie Ryan"` relative to the context named `"ou=People, o=JNDITutorial"`. Or you can name the entry `"cn=Vinnie Ryan, ou=People"` relative to the context named `"o=JNDITutorial"`. Or, you can create an initial context that points at the root of the LDAP server's namespace and name the entry `"cn=Vinnie Ryan, ou=People, o=JNDITutorial"`.

> In the JNDI, you can also use LDAP URLs to name LDAP entries. See the LDAP URL discussion in the JNDI Tutorial

Previous page: LDAP v3
Next page: How LDAP Operations Map to JNDI APIs