OpenLDAPAdminGuide/IntroductionToOpenldapDirectoryServices

Introduction to OpenLDAP Directory Services（介绍 OpenLDAP 目录服务）

This document describes how to build, configure, and operate OpenLDAP software to provide directory services. This includes details on how to configure and run the stand-alone LDAP daemon, slapd(8) and the stand-alone LDAP update replication daemon, slurpd(8). It is intended for newcomers and experienced administrators alike. This section provides a basic introduction to directory services and, in particular, the directory services provided by slapd(8).
该文档描述了如何编译，配置和运行OpenLDAP软件来提供目录服务。包含了如何配置和运行独立的LDAP daemon，slapd(8)，以及如何配置运行独立的LDAP更新复制daemon，slurpd(8)的详细信息。该文档面向新手和有经验的系统管理员。本部分提供了对目录服务的一个基本的介绍，特别是对slapd(8)提供的目录服务。

What is a directory service?（什么是目录服务）

A directory is a specialized database optimized for reading, browsing and searching. Directories tend to contain descriptive, attribute-based information and support sophisticated filtering capabilities. Directories generally do not support complicated transaction or roll-back schemes found in database management systems designed for handling high-volume complex updates. Directory updates are typically simple all-or-nothing changes, if they are allowed at all. Directories are tuned to give quick response to high-volume lookup or search operations. They may have the ability to replicate information widely in order to increase availability and reliability, while reducing response time. When directory information is replicated, temporary inconsistencies between the replicas may be okay, as long as they get in sync eventually.
一个目录服务是一个特殊的数据库，它为读，浏览和搜索进行了优化。目录可以用来保存描述性的，基于属性的信息，并且支持复杂的过滤搜索能力。目录通常不支持在数据库管理系统中为处理大量复杂更新而设计的并发事务或者回滚机制。目录更新只是一般的“全有或者全无”的更改——如果它们被允许的话。目录被优化为针对大量的查找或者搜索操作进行快速的响应。它们可以具有大范围复制信息的功能，以便提高可用性和可靠性，同时缩短响应时间。当目录中的信息被复制的时候，复本之间信息的暂时不一致是允许的，只要它们最终达到了一致。

There are many different ways to provide a directory service. Different methods allow different kinds of information to be stored in the directory, place different requirements on how that information can be referenced, queried and updated, how it is protected from unauthorized access, etc. Some directory services are local, providing service to a restricted context (e.g., the finger service on a single machine). Other services are global, providing service to a much broader context (e.g., the entire Internet). Global services are usually distributed, meaning that the data they contain is spread across many machines, all of which cooperate to provide the directory service. Typically a global service defines a uniform namespace which gives the same view of the data no matter where you are in relation to the data itself. The Internet Domain Name System (DNS) is an example of a globally distributed directory service.
有许多种不同的方法来提供一个目录服务。不同的方法允许在目录中存储不同种类的信息，因此，信息如何被引用、查询、更新以及如何保护其不被未经授权的访问也就不同。一些目录服务是本地的，只为有限的范围提供服务（如运行在单个机器上的 finger 服务）。另外一些服务则是全局的，为更广的范围提供服务（如整个国际互联网）。全局服务通常是分布的。这就意味着他们的数据分布在多台机器上，所有这些机器一起提供目录服务。典型情况下，全局服务定义一个统一的名字空间，无论您从哪里关连数据，该名字空间都将提供相同的数据视图。Internet 域名系统（DNS）就是一个全局分布式目录服务的实例。

What is LDAP?（什么是 LDAP）

LDAP stands for Lightweight Directory Access Protocol. As the name suggests, it is a lightweight protocol for accessing directory services, specifically X.500-based directory services. LDAP runs over TCP/IP or other connection oriented transfer services. The nitty-gritty details of LDAP are defined in RFC2251 "The Lightweight Directory Access Protocol (v3)" and other documents comprising the technical specification RFC3377. This section gives an overview of LDAP from a user's perspective.
LDAP 表示轻量级目录访问协议。正如其名字所示，它是一个用来访问目录服务，特别是基于X.500的目录服务的轻量级协议。LDAP 运行在TCP/IP协议或其他面向连接的传输服务上。LDAP 在 RFC2251 “轻型目录访问协议(V3)” 中定义，其技术说明包含在 RFC3377 中。本部分文档将从用户的角度给出对 LDAP 的概述。

What kind of information can be stored in the directory? The LDAP information model is based on entries. An entry is a collection of attributes that has a globally-unique Distinguished Name (DN). The DN is used to refer to the entry unambiguously. Each of the entry's attributes has a type and one or more values. The types are typically mnemonic strings, like "cn" for common name, or "mail" for email address. The syntax of values depend on the attribute type. For example, a cn attribute might contain the value Babs Jensen. A mail attribute might contain the value " [email protected] ". A jpegPhoto attribute would contain a photograph in the JPEG (binary) format.
什么类型的信息可以被保存在目录中？LDAP 信息模型是建立在“条目”（entries）的基础上。一个条目就是一个属性集，并具有一个全局唯一的“标识名” DN。该 DN 被用来明确引用该条目。每个条目的属性都有一个类型和一到多个值。类型通常是能帮助记忆的字符串，比如“cn”是常用名（common name），或者“mail”是电子邮件地址。条目值的语法取决于属性类型。如 cn 属性可能具有一个值“Babs Jensen”。一个 mail 属性可能包含值“ [email protected] ”。一个jpegphoto属性可能包含一幅JPEG（二进制）格式的图片。

How is the information arranged? In LDAP, directory entries are arranged in a hierarchical tree-like structure. Traditionally, this structure reflected the geographic and/or organizational boundaries. Entries representing countries appear at the top of the tree. Below them are entries representing states and national organizations. Below them might be entries representing organizational units, people, printers, documents, or just about anything else you can think of. Figure 1.1 shows an example LDAP directory tree using traditional naming.
信息是怎样组织的？在 LDAP 中，目录条目形成一个分层树结构。根据传统，该结构反映了地理的或者组织结构上的边界。代表国家的条目出现在树的顶部，下面是代表州或者地理组织的条目，它们下面可能是代表组织单元，个人，打印机，文档或者只是任何其他的你能想到的东西的条目。图1.1显示了一个使用传统命名方式的 LDAP 目录树的例子：

The tree may also be arranged based upon Internet domain names. This naming approach is becoming increasing popular as it allows for directory services to be located using the DNS. Figure 1.2 shows an example LDAP directory tree using domain-based naming.
该树同样可以根据 Internet 域名来安排。这种命名方式逐渐普遍，因为它允许目录服务使用域名系统来定位。图1.2显示了一个使用基于域名的命名方式的 LDAP 目录树的示例。

In addition, LDAP allows you to control which attributes are required and allowed in an entry through the use of a special attribute called objectClass. The values of the objectClass attribute determine the schema rules the entry must obey.
另外，LDAP通过使用一个特殊的，叫做 objectClass 的属性来允许您控制哪一个属性必须出现或者允许出现在一个条目中。objectClass 属性的值决定了该条目必须遵守的模式规则。

How is the information referenced? An entry is referenced by its distinguished name, which is constructed by taking the name of the entry itself (called the Relative Distinguished Name or RDN) and concatenating the names of its ancestor entries. For example, the entry for Barbara Jensen in the Internet naming example above has an RDN of uid=babs and a DN of uid=babs,ou=People,dc=example,dc=com. The full DN format is described in RFC2253, "Lightweight Directory Access Protocol (v3): UTF-8 String Representation of Distinguished Names."
信息是怎样被引用的？一个条目通过它的DN被引用。该DN使用如下方式构造：首先得到条目自己的名称（相对DN，RDN），然后连接上其祖先条目的名称。比如，图1.2的基于Internet的命名方式中的Barbara Jensen的条目，具有一个RDN：uid=babs。和一个DN：uid=babs,ou=People,dc=example,dc=com。完整的 DN 格式在RFC2253“Lightweight Directory Access Protocol (v3): UTF-8 String Representation of Distinguished Names” 中有描述。

How is the information accessed? LDAP defines operations for interrogating and updating the directory. Operations are provided for adding and deleting an entry from the directory, changing an existing entry, and changing the name of an entry. Most of the time, though, LDAP is used to search for information in the directory. The LDAP search operation allows some portion of the directory to be searched for entries that match some criteria specified by a search filter. Information can be requested from each entry that matches the criteria.
信息是如何被访问的？LDAP 定义了查询和更新目录的操作。还提供了从目录中增加和删除一个条目的操作，以及改变条目名称的操作（虽然大多数时间 LDAP 被用于在目录中搜索信息）。LDAP 搜索操作允许搜索目录的一部分，查找匹配由某个搜索过滤器指明的规则的条目。然后就可以从匹配规则的每一个条目中获取信息。

For example, you might want to search the entire directory subtree at and below dc=example,dc=com for people with the name Barbara Jensen, retrieving the email address of each entry found. LDAP lets you do this easily. Or you might want to search the entries directly below the st=California,c=US entry for organizations with the string Acme in their name, and that have a fax number. LDAP lets you do this too. The next section describes in more detail what you can do with LDAP and how it might be useful to you.
举个例子，您需要搜索在 dc=example,dc=com 条目之中或者之下的整个目录子树，查找一个名字叫做 Barbara Jensen 的个人，并且获取每一个找到的条目的电子邮件地址。LDAP 让您简单的做到这一点。或者，您可能需要搜索直接在 st=California,c=US 条目之下的条目，查找一个组织名字中包含字符串 Acme，并且具有传真号码的组织。LDAP 也允许您做到这一点。下一部分将更详细的描述您可以使用 LDAP 做什么，以及它怎样对您有用。

How is the information protected from unauthorized access? Some directory services provide no protection, allowing anyone to see the information. LDAP provides a mechanism for a client to authenticate, or prove its identity to a directory server, paving the way for rich access control to protect the information the server contains. LDAP also supports data security (integrity and confidentiality) services.
如何保护信息不被未经授权的访问？一些目录服务提供了未经保护、允许任何人都能看到的信息。LDAP 提供了一种机制，让客户端进行认证，或者向目录服务器证实它的身份，这为保护服务器中的信息提供丰富的访问控制方式。LDAP 同时还支持数据安全（完整性和机密性）服务。

How does LDAP work?（LDAP 如何工作？）

LDAP directory service is based on a client-server model. One or more LDAP servers contain the data making up the directory information tree (DIT). The client connects to servers and asks it a question. The server responds with an answer and/or with a pointer to where the client can get additional information (typically, another LDAP server). No matter which LDAP server a client connects to, it sees the same view of the directory; a name presented to one LDAP server references the same entry it would at another LDAP server. This is an important feature of a global directory service, like LDAP.
LDAP 目录是基于 C/S 方式的。一个或多个包含数据的 LDAP 服务器组成目录信息树（DIT）。客户连接到服务器并向其询问，服务器返回答案或一个指向能得到附加信息地方的指针（通常是另一个LDAP服务器）。无论客户连到哪一个 LDAP 服务器，它都将看到相同的目录视图。出现在一个 LDAP 服务器的名字将关联另一个 LDAP 服务器中相同的条目。这是全局目录服务的一个重要特性，如 LDAP。

What about X.500?（关于 X.500）

Technically, LDAP is a directory access protocol to an X.500 directory service, the OSI directory service. Initially, LDAP clients accessed gateways to the X.500 directory service. This gateway ran LDAP between the client and gateway and X.500's Directory Access Protocol (DAP) between the gateway and the X.500 server. DAP is a heavyweight protocol that operates over a full OSI protocol stack and requires a significant amount of computing resources. LDAP is designed to operate over TCP/IP and provides most of the functionality of DAP at a much lower cost.
从技术上说，LDAP 是一个 X.500 目录服务（OSI目录服务）的目录访问协议。最初，LDAP客户端通过网关访问目录服务。该网关运行在客户和网关之间使用的LDAP 和在网关和X.500服务器之间使用的 X.500 的目录访问协议（DAP）。DAP 是一个重量级的协议，运行在完整安全的OSI协议栈之上，需要消耗大量的计算资源。LDAP 被设计运行在 TCP/IP 上，并以低的多的代价提供 DAP 所能提供的大部分功能。

While LDAP is still used to access X.500 directory service via gateways, LDAP is now more commonly directly implemented in X.500 servers.
虽然 LDAP 仍然时常通过网关来访问 X.500 目录服务，但是现在，LDAP 更多的是直接在 X.500 服务器上实现。

The stand-alone LDAP daemon, or slapd(8), can be viewed as a lightweight X.500 directory server. That is, it does not implement the X.500's DAP nor does it support the complete X.500 models.
独立的 LDAP 守护程序，或者说 slapd(8)，可以被看作是一个轻量级的 X.500 目录服务器。也就是说，它没有实现 X.500 的 DAP 或者说它并不支持完整的 X.500 模型。

If you are already running a X.500 DAP service and you want to continue to do so, you can probably stop reading this guide. This guide is all about running LDAP via slapd(8), without running X.500 DAP. If you are not running X.500 DAP, want to stop running X.500 DAP, or have no immediate plans to run X.500 DAP, read on.
如果您已经运行了一个 X.500 DAP 服务器，并且您还想继续这样做，那么您可以停止阅读本指南了。本指南都是关于通过 slapd(8) 来运行 LDAP 的，而不是运行X.500 DAP 的。如果您没有运行 X.500 DAP、想停止运行 X.500 DAP或者没有马上运行 X.500 DAP 的计划，请继续阅读。

It is possible to replicate data from an LDAP directory server to a X.500 DAP DSA. This requires an LDAP/DAP gateway. OpenLDAP does not provide such a gateway, but our replication daemon can be used to replicate to such a gateway. See the Replication with slurpd chapter of this document for information regarding replication.
从一个 LDAP 目录服务器向一个 X.500 DAP DSA 复制数据是可行的。它需要一个 LDAP/DAP 网关。OpenLDAP 并没有提供这样一个网关。但是，我们的复制守护程序可以被用来向这种网关进行复制。参阅本文档的“使用SLURPD进行复制”一章获得关于复制的信息。

What is the difference between LDAPv2 and LDAPv3?（LDAP V2 和 LDAP V3 的不同）

LDAPv3 was developed in the late 1990's to replace LDAPv2. LDAPv3 adds the following features to LDAP:
LDAPv3 在 20 世纪 90 年代后期才开始开发用以取代 LDAPv2。LDAPV3增加了以下特性：

• Strong authentication and data security services via SASL
  使用 SASL 进行高强度认证和数据安全服务；
• Certificate authentication and data security services via TLS (SSL)
  使用 TLS(SSL) 进行证书认证和数据安全服务；
• Internationalization through the use of Unicode
  使用 Unicode 支持国际化
• Referrals and Continuations
  引用和延续
• Schema Discovery
  支持模式发现
• Extensibility (controls, extended operations, and more)
  可扩展性（控制、扩展操作及更多）

LDAPv2 is historic (RFC3494). As most so-called LDAPv2 implementations (including slapd(8)) do not conform to the LDAPv2 technical specification, interoperatibility amongst implementations claiming LDAPv2 support is limited. As LDAPv2 differs significantly from LDAPv3, deploying both LDAPv2 and LDAPv3 simultaneously is quite problematic. LDAPv2 should be avoided. LDAPv2 is disabled by default.
LDAPv2 已经成为历史（RFC3494）。许多所谓 LDAPv2 的实现（包括 slapd(8)）都不符合 LDAPv2 的技术说明，在它们声明支持 LDAPv2 的互操作是有限的。LDAPv2 与 LDAPv3 有着很大程度上的不同，同时部署 LDAPv2 和 LDAPv3 是相当困难的，应尽量避免使用 LDAPv2。LDAPv2 缺省是不可用的。

What is slapd and what can it do?（slapd 及其作用）

slapd(8) is an LDAP directory server that runs on many different platforms. You can use it to provide a directory service of your very own. Your directory can contain pretty much anything you want to put in it. You can connect it to the global LDAP directory service, or run a service all by yourself. Some of slapd's more interesting features and capabilities include:
slapd(8)是一个能运行在很多平台上的 LDAP 服务器。您可以用它来提供您自己的目录服务。您的目录可以包含您想放置其中的任意多的信息。您可以将它连接到一个全局的 LDAP 目录服务，或者只是为您自己运行一个服务。以下包括 slapd 更多有趣的特性和功能：

LDAPv3:slapd implements version 3 of Lightweight Directory Access Protocol. slapd supports LDAP over both IPv4 and IPv6 and Unix IPC.
LDAPv3：slapd 实现了第三版的轻量级目录访问协议。slapd 支持 IPv4、IPv6 和 Unix IPC。

Simple Authentication and Security Layer:slapd supports strong authentication and data security (integrity and confidentiality) services through the use of SASL. slapd's SASL implementation utilizes Cyrus SASL software which supports a number of mechanisms including DIGEST-MD5, EXTERNAL, and GSSAPI.
简单认证和安全层：slapd 通过使用 SASL 来支持高强度认证服务和数据安全（完整性和保密性）。slapd 的SASL实现 使用了Cyrus SASL 软件，该软件支持大量的认证机制，包括 DIGEST-MD5，EXTERNAL 和 GSSAPI。

Transport Layer Security:slapd supports certificate-based authentication and data security (integrity and confidentiality) services through the use of TLS (or SSL). slapd's TLS implementation utilizes OpenSSL software.
传输层安全：slapd通过使用TLS提供隐私和完整的保护。slapd的TLS实现工具是OpenSSL软件。

Topology control: slapd can be configured to restrict access at the socket layer based upon network topology information. This feature utilizes TCP wrappers.
拓扑控制：slapd能被配置成基于网络拓扑信息的套接字层的访问限制。该功能利用TCP wrappers.

Access control:slapd provides a rich and powerful access control facility, allowing you to control access to the information in your database(s). You can control access to entries based on LDAP authorization information, IP address, domain name and other criteria. slapd supports both static and dynamic access control information.
访问控制：slapd提供丰富和强大的访问控制，允许你控制访问你的数据库中的信息。你能控制访问条目基于LDAP验证信息，IP地址，域名和其它的标准。slapd既支持静态又支持动态的访问控制信息。

Internationalization:slapd supports Unicode and language tags.
国际化：slapd支持Unicode和语言标签

Choice of database backends:slapd comes with a variety of different database backends you can choose from. They include BDB, a high-performance transactional database backend; HDB, a hierarchical high-performance transactional backend; LDBM, a lightweight DBM based backend; SHELL, a backend interface to arbitrary shell scripts; and PASSWD, a simple backend interface to the passwd(5) file. The BDB and HDB backends utilize Sleepycat Berkeley DB. The LDBM utilizes either Berkeley DB or GDBM.
後台数据库的选择：slapd能支持多种不同的後台数据库；LDBM，一个轻量级後台DBM；SHELL，一个人意的shell脚本後台接口； PASSWD，一个简单的到passwd文件的後台接口。BDB後台使用Sleepycat Berkeley DB。LDBM使用Berkeley DB或GDBM。

Multiple database instances:slapd can be configured to serve multiple databases at the same time. This means that a single slapd server can respond to requests for many logically different portions of the LDAP tree, using the same or different database backends.
多数据库实例：slapd能配置成同时运行多个数据库。意思是单个slapd服务器能同时响应到多个逻辑上不同的LDAP树的部分的请求，使用相同的或不同的後台数据库。

Generic modules API:If you require even more customization, slapd lets you write your own modules easily. slapd consists of two distinct parts: a front end that handles protocol communication with LDAP clients; and modules which handle specific tasks such as database operations. Because these two pieces communicate via a well-defined C API, you can write your own customized modules which extend slapd in numerous ways. Also, a number of programmable database modules are provided. These allow you to expose external data sources to slapd using popular programming languages (Perl, shell, SQL, and TCL).
通用模块API：如果需要更多的定制，slapd 可以让您轻松编写您自己的模块。slapd 由两个不同的部分组成：一个负责处理 LDAP 客户端协议通讯的前台；和负责处理数据库操作任务的模块。因为这两个部分之间通过定义良好的 C API 进行通信，您可以编写您自己的定制模块并用多种方式来扩展 slapd。同时，slapd 还提供了多个可编程的数据库模块。这允许您使用通用的编程语言（PERL，SHELL，SQL和TCL）将外部数据源开放给SLAPD。

Threads:slapd is threaded for high performance. A single multi-threaded slapd process handles all incoming requests using a pool of threads. This reduces the amount of system overhead required while providing high performance.
线程：slapd 是用线程来达到高性能。一个多线程的 slapd 进程使用线程池处理所有来访请求。在提供高性能的服务的同时该功能减少了大量的系统开销。

Replication:slapd can be configured to maintain shadow copies of directory information. This single-master/multiple-slave replication scheme is vital in high-volume environments where a single slapd just doesn't provide the necessary availability or reliability. slapd supports two replication methods: LDAP Sync-based and slurpd(8)-based replication.
复制：slapd 能够被配置成为维护目录信息的影子拷贝。这种单主/多从的复制模式在单个 slapd 不足以提供有效性或可靠性的大吞吐量的环境下是至关重要的。slapd 支持两种复制方法：基于 LDAP 同步的和基于 slurpd 的复制。

Proxy Cache:slapd can be configured as a caching LDAP proxy service.
代理缓存：slapd 可以被配为缓存 LDAP 代理服务（caching LDAP proxy service）。

Configuration:slapd is highly configurable through a single configuration file which allows you to change just about everything you'd ever want to change. Configuration options have reasonable defaults, making your job much easier.

可配置性：slapd 通过一个配置文件来实现高可配置性。此配置文件允许您改变任何需要改变的东西。配置选项有着合理的缺省值，这将使您的工作更加容易。

What is slurpd and what can it do?（slurpd 及其作用）

slurpd(8) is a daemon that, with slapd help, provides replicated service. It is responsible for distributing changes made to the master slapd database out to the various slapd replicas. It frees slapd from having to worry that some replicas might be down or unreachable when a change comes through; slurpd handles retrying failed requests automatically. slapd and slurpd communicate through a simple text file that is used to log changes.
slurpd(8) 是一个在 slapd 协助下提供复制服务的守护程序。它负责将对主 slapd 数据库的修改分发到不同的 slapd 的副本上。它使得 slapd 不用去考虑发生改变时，某些副本可能当机或不能访问。slurpd 会自动重新尝试失败的请求。slapd 和 slurpd 是通过一个记录改变的纯文本文件来通信的。

See the Replication with slurpd chapter for information about how to configure and run slurpd(8).
通过参看 slurpd 复制一章来得到如何配置和运行 slurpd(8) 的相关信息。

Alternatively, LDAP-Sync-based replication may be used to provide a replicated service. See the LDAP Sync Replication chapter for details.
相应的，基于 LDAP 同步的复制用于提供一个复制服务。详情请参见 LDAP 同步复制章节。