CACANet勉強会ビギナーコース：2001年5月14日（月曜） 講師：桑山雅行（CACAnet福岡） kuwayama@cacanet.org 最終修正：2001年5月14日12時
Netscape CommunicatorやMicrosoft Outlook等での，ネットワーク上でどこからでも参照できるアドレス帳を作成することができる．
デジタル証明書やCRLを格納するリポジトリとして使用可能．
※SSL/TLSを使用する場合には，bind操作の前にすでに認証は終っているという点に注意が必要である．
rfc2293 Tables and Subtrees in the X.500 Directory (PS) rfc2307 LDAP Network Information Services Schema (I) rfc2377 LDAP Naming Plan (I) rfc2559 Internet X.509 PKI Operational Protocols - LDAPv2 (PS) rfc2587 Internet X.509 PKI LDAPv2 Schema (PS) rfc2589 LDAPv3: Dynamic Directory Services Extensions (PS) rfc2596 Use of Language Codes in LDAP (PS) rfc2696 LDAP Simple Paged Result Control (PS) rfc2713 LDAP Java schema (I) rfc2714 LDAP COBRA schema (I) rfc2798 LDAP inetOrgPerson schema (I) rfc2829 LDAPv3: Authentication Methods (PS) rfc2830 LDAPv3: StartTLS (PS) rfc2831 SASL/DIGEST-MD5 (PS) rfc2849 LDIFv1 (PS) rfc2891 LDAPv3: Server Side Sorting of Search Results (PS) rfc3045 Storing Vendor Information in the LDAP root DSE (I) rfc3062 LDAP Password Modify Extended Operation (PS) rfc3088 OpenLDAP Root Service (E) draft-byrne-ldap-alias-xx.txt draft-ietf-asid-ldapv3-attributes-03.txt draft-ietf-ldapext-ldap-c-api-xx.txt draft-ietf-ldapext-locate-xx.txt draft-lachman-laser-ldap-mail-routing-xx.txt draft-rharrison-ldap-extpartresp-xx.txt draft-zeilenga-ldap-namedref-xx.txt draft-zeilenga-ldapv3bis-opattrs-xx.txt
Netscape Navigatorでは，LDAP URLと呼ばれるURLを 「場所:」の部分に直接，あるいは「場所を指定して開く」で入力することにより， LDAPサーバからの検索を行うことができます．
ここでは，LDAP URLを使用したLDAPサーバの検索を行ってみましょう．
LDAP URLは，RFC2255で次のように規定されています．
ldapurl = scheme "://" [hostport] ["/"
[dn ["?" [attributes] ["?" [scope]
["?" [filter] ["?" extensions]]]]]]
scheme = "ldap"
attributes = attrdesc *("," attrdesc)
scope = "base" / "one" / "sub"
dn = distinguishedName from Section 3 of [1]
hostport = hostport from Section 5 of RFC 1738 [5]
attrdesc = AttributeDescription from Section 4.1.5 of [2]
filter = filter from Section 4 of [4]
extensions = extension *("," extension)
extension = ["!"] extype ["=" exvalue]
extype = token / xtoken
exvalue = LDAPString from section 4.1.2 of [2]
token = oid from section 4.1 of [3]
xtoken = ("X-" / "x-") token
これを見ると何だか難しそうなので，いくつか例を挙げてみます．
IPアドレス10.0.0.130というホストで管理されている， o=CACAnet Fukuoka,c=JPというエントリの情報が表示されます．
# $OpenLDAP: pkg/ldap/servers/slapd/slapd.conf,v 1.8.8.6 2001/04/20 23:32:43 kurt Exp $ # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /usr/local/openldap-2.0.8/etc/openldap/schema/core.schema include /usr/local/openldap-2.0.8/etc/openldap/schema/cosine.schema include /usr/local/openldap-2.0.8/etc/openldap/schema/inetorgperson.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /usr/local/openldap-2.0.8/var/slapd.pid argsfile /usr/local/openldap-2.0.8/var/slapd.args # Load dynamic backend modules: # modulepath /usr/local/openldap-2.0.8/libexec/openldap # moduleload back_ldap.la # moduleload back_ldbm.la # moduleload back_passwd.la # moduleload back_shell.la ####################################################################### # ldbm database definitions ####################################################################### database ldbm suffix "c=JP" rootdn "cn=Manager,c=JP" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw secret # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd/tools. Mode 700 recommended. directory /usr/local/openldap-2.0.8/var/openldap-ldbm # Indices to maintain index objectClass eq
dn: c=JP objectclass: country c: JP dn: l=Fukuoka City,c=JP objectclass: locality l: Fukuoka City st: Fukuoka Prefecture dn: l=Kitakyushu City,c=JP objectclass: locality l: Kitakyushu City st: Fukuoka Prefecture dn: cn=KUWAYAMA Masayuki,l=Fukuoka City,c=JP objectclass: inetOrgPerson sn: KUWAYAMA sn: 桑山 cn: KUWAYAMA Masayuki cn: 桑山雅行 userPassword: masayuki-kuwayama telephoneNumber: +81-92-000-0000 mail: kuwayama@i-kyushu.or.jp jpegPhoto:: /9j/4AAQSkZJRgABAQAAAQABAAD//gBHQ1JFQVRPUjogWFYgVmVyc2lvbiAzLjEwI CBSZXY6IDEyLzE2Lzk0ICBRdWFsaXR5ID0gNzUsIFNtb290aGluZyA9IDAK/9sAQwAIBgYHBgUIB wcHCQkICgwUDQwLCwwZEhMPFB0aHx4dGhwcICQuJyAiLCMcHCg3KSwwMTQ0NB8nOT04MjwuMzQy/ (・・・中略・・・) dn: cn=KUWAYAMA Miyuki,l=Fukuoka City,c=JP objectclass: person sn: KUWAYAMA sn: 桑山 cn: KUWAYAMA Miyuki cn: 桑山美幸 userPassword: miyuki-kuwayama telephoneNumber: +81-92-000-0000 dn: cn=桑山知己,l=Fukuoka City,c=JP objectclass: inetOrgPerson sn: KUWAYAMA sn: 桑山 cn: KUWAYAMA Tomoki cn: 桑山知己 userPassword: tomoki-kuwayama telephoneNumber: +81-92-000-0000 jpegPhoto:: /9j/4AAQSkZJRgABAQEBLAEsAAD/2wBDAAMCAgMCAgMDAwMEAwMEBQgFBQQEBQoHB wYIDAoMDAsKCwsNDhIQDQ4RDgsLEBYQERMUFRUVDA8XGBYUGBIUFRT/2wBDAQMEBAUEBQkFBQkUD QsNFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBT/wAARC (・・・中略・・・) dn: o=CACAnet Fukuoka,c=JP objectclass: organization o: CACAnet Fukuoka dn: ou=User,o=CACAnet Fukuoka,c=JP objectclass: organizationalUnit ou: User dn: cn=KUWAYAMA Masayuki,ou=User,o=CACAnet Fukuoka,c=JP objectclass: inetOrgPerson sn: KUWAYAMA cn: KUWAYAMA Masayuki sn: 桑山 cn: 桑山雅行 mail: kuwayama@cacanet.org dn: cn=YAMASAKI Shigeichiro,ou=User,o=CACAnet Fukuoka,c=JP objectclass: inetOrgPerson sn: YAMASAKI cn: YAMASAKI Shigeichiro sn: 山崎 cn: 山崎重一郎 mail: tonton@cacanet.org