What are CN, OU, DC in an LDAP search?
Solution 1
-
CN
= Common Name -
OU
= Organizational Unit -
DC
= Domain Component
These are all parts of the X.500 Directory Specification, which defines nodes in a LDAP directory.
You can also read up on LDAP data Interchange Format (LDIF
), which is an alternate format.
You read it from right to left, the right-most component is the root of the tree, and the left most component is the node (or leaf) you want to reach.
Each =
pair is a search criteria.
With your example query
("CN=Dev-India,OU=Distribution Groups,DC=gp,DC=gl,DC=google,DC=com");
In effect the query is:
From the com
Domain Component, find the google
Domain Component, and then inside it the gl
Domain Component and then inside it the gp
Domain Component.
In the gp
Domain Component, find the Organizational Unit called Distribution Groups
and then find the object that has a common name of Dev-India
.
Solution 2
What are CN, OU, DC?
From RFC2253 (UTF-8 String Representation of Distinguished Names):
String X.500 AttributeType
------------------------------
CN commonName
L localityName
ST stateOrProvinceName
O organizationName
OU organizationalUnitName
C countryName
STREET streetAddress
DC domainComponent
UID userid
**What does the string from that query mean?**
The string ("CN=Dev-India,OU=Distribution Groups,DC=gp,DC=gl,DC=google,DC=com"
) is a path from an hierarchical structure (DIT = Directory Information Tree) and should be read from right (root) to left (leaf).
It is a DN (Distinguished Name) (a series of comma-separated key/value pairs used to identify entries uniquely in the directory hierarchy). The DN is actually the entry's fully qualified name.
Here you can see an example where I added some more possible entries.
The actual path is represented using green.
The following paths represent DNs (and their value depends on what you want to get after the query is run):
"DC=gp,DC=gl,DC=google,DC=com"
"OU=Distribution Groups,DC=gp,DC=gl,DC=google,DC=com"
"OU=People,DC=gp,DC=gl,DC=google,DC=com"
"OU=Groups,DC=gp,DC=gl,DC=google,DC=com"
"CN=QA-Romania,OU=Distribution Groups,DC=gp,DC=gl,DC=google,DC=com"
"CN=Dev-India,OU=Distribution Groups,DC=gp,DC=gl,DC=google,DC=com"
"CN=Diana Anton,OU=People,DC=gp,DC=gl,DC=google,DC=com"
Solution 3
I want to add somethings different from definitions of words. Most of them will be visual.
Technically, LDAP is just a protocol that defines the method by which directory data is accessed.Necessarily, it also defines and describes how data is represented in the directory service
Data is represented in an LDAP system as a hierarchy of objects, each of which is called an entry. The resulting tree structure is called a Directory Information Tree (DIT). The top of the tree is commonly called the root (a.k.a base or the suffix).
To navigate the DIT we can define a path (a DN) to the place where our data is (cn=DEV-India,ou=Distrubition Groups,dc=gp,dc=gl,dc=google,dc=com will take us to a unique entry) or we can define a path (a DN) to where we think our data is (say, ou=Distrubition Groups,dc=gp,dc=gl,dc=google,dc=com) then search for the attribute=value or multiple attribute=value pairs to find our target entry (or entries).
If you want to get more depth information, you visit here
Solution 4
At least with Active Directory, I have been able to search by DistinguishedName by doing an LDAP query in this format (assuming that such a record exists with this distinguishedName):
"(distinguishedName=CN=Dev-India,OU=Distribution Groups,DC=gp,DC=gl,DC=google,DC=com)"
Ritesh Chandora
Freelance coder... like to create new logic... Professional Photographer and editor..
Updated on July 08, 2022Comments
-
Ritesh Chandora almost 2 years
I have a search query in LDAP like this. What exactly does this query mean?
("CN=Dev-India,OU=Distribution Groups,DC=gp,DC=gl,DC=google,DC=com");
-
user207421 about 9 yearsThese are all part of the X.500 Directory specification, Distinguised Name component. Nothing specifically to do with LDIF at all. LDIF is not "how the LDAP tree is 'filtered'": that's the LDAP syntax specification, which is another thing altogether.
-
A_Di-Matteo over 7 yearsAny idea why you may get an empty remaining name? For this there is actually an open bounty on it
-
ThorSummoner over 6 yearsTIL X.509 is an extension of X.500, eg TLS is based on LDAP :grumpycat: (This is a huge oversimplification)
-
arrowd over 6 years@EJP How do I ask for several objects by their CN? Like if I want
Dev-India2
along withDev-India
? -
Artanis Zeratul almost 6 years@ROMANIA_engineer, if I am logged in my windows machine (client) where can I get this information?
-
Rüdiger over 5 yearsI know this post is quite old, yet, for the googlers (like me) that search for an answer on @ArtanisZeratul question for the information: this answer helped me on that, if you look for the servers just try with nslookup:
nslookup -type=srv _ldap._tcp.MY.DOMAIN
-
Rüdiger over 5 yearsAlso, for those that need deeper information about the structure of the AD they're in (and do not have something like an Admin Console to look it up) you can use the ADSI editor provided by Windows (access via MMC) - how to access ADSI Edit
-
strongmmc about 2 years@arrowd read ldap.com/ldap-filters. You could use the OR operator (a pipe follwed by the entries) or the SUBSTRING operator (star operator). OR >
(|(cn=Dev-India2)(cn=Dev-India))
SUBSTRING >(cn=Dev-India*)