Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I know an LDAP search base suffix generally matches the directory server's host name. In other words, I know if the host name is od.foobar.com, I should use the search base suffix: dc=od,dc=foorbar,dc=com

It bothers me to not understand why I'm doing this. Could someone provide some background and explain precisely what I'm doing?

share|improve this question
2  
I strongly disagree with the word "generally". Most LDAP sites use the delegated domain name (here foobar.com) NOT the server's hostname. –  bortzmeyer May 26 '09 at 7:21
add comment

4 Answers

up vote 7 down vote accepted

Prior to Microsoft 'embracing, extending, and changing' LDAP, most implementations had objects to represent the root of the tree. I.e. You have to start from somewhere.

For reasons I am not completely clear on, in Active Directory, each Domain in the tree/forest is rooted with a name that dc=domain,dc=com that is not really two separate objects, rather it is a virtual root of the directory name space.

I think that some of it comes from the fact, that regardless of what is said about Active Directory, it is still a series of linked domains, and each domain needs to be treated as a standalone entity.

Now there are automatic transitive trusts within an AD tree, so that makes it matter less to end users, but even though the namespace looks kind of contiguous, it isn't really.

This becomes more evident with some of the naming rules with AD. For example sAMAccountName must be unique within a domain, regardless of whether they are in the same container or not. I.e. The full distinguished name must be unique, (you cannot have two John Smith users in the same container) but the shortname that is used for many things internally (sAMAccountName) needs to be unique within the entire domain.

Other directory services either have somewhat similar requirements, like uniqueID should really be unique within the entire directory, but that is more because applications usually make that assumption, as application writers have been too lazy to deal with the complex issue (I don't blame them, it is a hard problem) of how to handle two users with short names of jsmith trying to use a service, but existing in two different containers. (I.e. Perhaps cn=jsmith,ou=London,dc=acme,dc=com and cn=jsmith,ou=Texas,dc=acme,dc=com).

How should your application using this directory decide which user to use? The usual answer is let the user decide. But that means catching this case, presenting a UI to the user choose from and whatnot.

Most application writers just ignore that possibility and just use uniqueID or sAMAccountName because that is unique (sort of) and easier to do.

The difference between uniqueID and sAMAccountName would be that uniqueID should be unique throughout the directory name space. Whereas sAMAccountName is only guaranteed unique within the domain. If the AD tree has several domains, there is no guarentee there of uniqueness, between domains.

share|improve this answer
    
I'm not sure if this even answers the question. Either the question isn't worded very well or my head is spinning too much. –  ThatGraemeGuy Jun 5 '09 at 9:48
1  
I think the WHY is somewhat arbitrary. You have to start somewhere, and X.500 which LDAP is based on says, you have to have a root to your tree. (Else it topples over?) Is the question WHY start somewhere? Why start here specifically? –  geoffc Jun 5 '09 at 17:45
add comment

Others have explained why using a domain name is a good idea (but is not mandatory). I just add that the question is wrong: having a base suffix based on the name of a machine is not recommended at all (for obvious reasons: what if you replace gandalf.example.com by sarouman.example.com ?). You typically only use the delegated domain name so, if you have example.com, you use dc=example,dc=com.

share|improve this answer
    
+1 nice observation. Totally missed that one :D –  Commander Keen May 26 '09 at 7:53
add comment

The root of the directory has to be set to something. It could be set to whatever you like. Setting it to the domain name is simply a useful convention that ensures your directory name space is unique.

share|improve this answer
add comment

Short version: Match your domain-name as a guarantee that the base path is unique.

Do it, and you won't look like a newb admin if your company merges with another one, and you need to merge systems :)

Ok, that was a very short version =)

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.