Directory Structure: DNs, Attributes & Object Classes

A Directory, Not a Relational Database

LDAP (Lightweight Directory Access Protocol) is a standard protocol for accessing and maintaining distributed directory information. Directories are hierarchical, tree-structured stores optimized for fast, read-heavy lookups of relatively static, attribute-based information — user records, organizational structure — not the complex transactional writes relational databases are built for.

The Directory Information Tree

dc=example,dc=com
└── ou=Engineering
    └── cn=Jane Doe,ou=Engineering,dc=example,dc=com
        uid: jdoe
        cn: Jane Doe
        mail: jane.doe@example.com
        memberOf: cn=engineers,ou=Groups,dc=example,dc=com

The Distinguished Name (DN) uniquely identifies an entry by its full path in the tree. Organizational units (OUs) are container-like folders that organize the tree — often mirroring an organization's real departments — while attributes (uid, cn, mail) hold the actual data on a given entry.

Object Classes — the Schema

An object class (e.g. inetOrgPerson) defines which attributes an entry must or may have — similar in spirit to a class or interface defining required and optional fields. uid conventionally holds the login username, distinct from cn (the display name).

Group Membership & Authorization

The memberOf attribute (or the member attribute on a group entry) represents group membership — the foundational mechanism many applications use to drive role-based access control decisions from a single centralized identity source.