MACROMEDIA ColdFusion MX, Develop Manual

Page: 481 / 860

The LDAP information structure 481
An entry’s DN consists of an entry’s RDN followed by the DN of its parent. In other words, it
consists of the RDNs for the entry and each of the entry’s parent entries, up to the root of the
directory tree. The RDNs are separated by commas and optional spaces. For example, in the first
figure, the DN for the Ferrari entry is “o=Ferrari, c=Italy”.
As with file system pathnames and URLs, entering the correct LDAP name format is essential to
successful search operations.
Note: The RDN is an attribute of a directory entry. The full DN is not. However, you can output the full
DN by specifying "dn" in a query’s
attributes
list. For more information, see
cfldap
in CFML
Reference . ColdFusion always returns DNs with spaces after the commas.
A multivalued RDN is made up of more than one attribute-value pair. In multivalued RDNs, the
attribute-value pairs are separated by plus signs (+). In the sample directories, individuals could
have complex RDNs consisting of their common name and their e-mail address; for example,
“cn=Robert Boyd + mail=rjboyd@macromedia.com”.
Schema
The concepts of schemas and object classes are central to a thorough understanding of LDAP.
Although detailed descriptions of them are beyond the scope of this chapter, the following
sections provide enough information to use the
cfldap
tag effectively.
A directory schema is a set of rules that determines what can be stored in a directory. It defines, at
a minimum, the following two basic directory characteristics:
•
The object classes to which entries can belong
•
The directory attribute types
Object class
Object classes enable LDAP to group related information. Frequently, an object class corresponds
to a real object or concept, such as a country, person, room, or domain (in fact, these are all
standard object type names). Each entry in an LDAP directory must belong to one or more object
classes.
The following characteristics define an object class:
•
The class name
•
A unique object ID that identifies the class
•
The attribute types that entries of the class must contain
•
The attribute types that entries of the class can optionally contain
•
(Optional) A superior class from which the class is derived
If an entry belongs to a class that derives from another class, the entry’s objectclass attribute lists
the lowest-level class and all the superior classes from which the lowest-level class derives.
When you add, modify, or delete a directory entry, you must treat the entry’s object class as a
possibly multivalued attribute. For example, when you add a new entry, you specify the object
class in the
cfldap
tag
attributes
attribute. To retrieve an entry’s object class names, specify
“objectclass” in the list of query attributes. To retrieve entries that provide a specific type of
information, you can use the object class name in the
cfldap
tag
filter
attribute.