Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What are a DN (Distinguished Name) and a Base DN in LDAP?
Short answer
A DN (Distinguished Name) is the full and unique name of an object in the directory; it is written from the most specific part to the most general, separated by commas, e.g. CN=Service Account,CN=Users,DC=company,DC=com (RFC 4514). A Base DN, on the other hand, is the directory branch where a search starts, e.g. DC=company,DC=com for the whole domain, OU=Personel,DC=company,DC=com for only one unit; the search is done under this branch. In TR7 AGS, an Authentication Provider of the LDAP type, in the Search and Bind method, binds to the directory with Service Account DN, searches for the user under Search Base DN and tries the password with the DN of the user found; the group search is done under Group Search Base. For management users, on the LDAP Settings screen, the user is searched for under Base DN after binding; if Base DN is empty, this search is not done; for the user's login, it is enough for the password to be verified in the directory.
Where It Is Used in TR7
| Where | Field / label | What for |
|---|---|---|
| AGS → Authentication → Authentication Providers (LDAP, Search and Bind) | Service Account DN, Service Account Password, Search Base DN | The account that will search the directory, and the branch where the user will be searched for |
| Same form (LDAP, Direct Bind) | Bind Template: User Container in the UID and CN options, Custom Bind Pattern in Custom | Building the DN directly from the username (e.g. uid=ali,ou=users,…) |
| Same form (LDAP) | Enable Group Search, Group Search Base, Group Filter | The branch where the groups will be searched for; the default Group filter searches for the user's DN in the member attribute of the groups |
| Settings → User Management → LDAP Settings | Base DN | The branch where the management user will be searched for after bind |
| Same screen | LDAP Query User, LDAP Search Base | The query account and the branch from which the user's e-mail and phone information will be read |
Parts of a DN
| Abbreviation | Meaning | Example |
|---|---|---|
| CN | Common Name | CN=Ali Veli |
| OU | Organizational Unit | OU=Personel |
| DC | Domain Component | DC=company,DC=com |
| UID | User ID; mostly used in OpenLDAP | uid=ali |
The reading order is from left to right, from specific to general: CN=Ali Veli,OU=Personel,DC=company,DC=com means "Ali Veli in the Personel unit in the company.com domain".
Common Misconceptions
- "The broader the Base DN, the better." A very broad branch slows down the search and also covers unwanted accounts; the narrowest branch that contains the users who can log in is selected. For narrowing at management login, LDAP Bind Restriction Filter is also used.
- "The DN and the username are the same." The username (e.g. sAMAccountName) can be only one part of the DN; the DN is the full path of the object in the directory.
- "If Base DN is left empty in LDAP Settings, no one can log in." On the contrary: if Base DN is empty, no search is done after bind; a user whose Authorization Source value in Device Users is LDAP (or who is created at first login while Automatic User Creation is on) logs in when the password is verified in the directory. The user's permissions still come from the user's own User Type value.
How it is done in the documentation
