Ldap - Configuration Parameters


When you have to configure a software to authenticate against an LDAP application, this informations are often asked :

When you need to search for an entry in LDAP, you must provide the base (Base Dn) of the search and a filter.


Base DN

The Base DN is the starting point in the hierarchy at which your search will begin (often for a user or a group).

Think of the Base DN as the “top” of the directory for your LDAP users although it may not always the top of the directory itself. The search base may be something equivalent to the organization, group, or domain name (AD) of external directory.

  • o=corp - Exchange 5.5
  • o=corp,c=us - Lotus Domino
  • dc=domain,dc=com - Active Directory, OpenLDAP
  • ou=Mail Users,dc=domain,dc=com - Active Directory restricting to “Mail Users” organizational unit

It identifies the starting point of the authentication search.

For example, if you want to search all of the entries under the o=Oracle.com subtree of the directory, the base DN is :


This is a path to a LDAP directory which lets you find object (user, group, …)

Example :

  • For a directory
    • CN=Users,DC=mydomain,DC=myextension
    • CN=Users,DC=gerardnico,DC=com
  • For a user in the directory Users
    • CN=UserNico,CN=Users,DC=gerardnico,DC=local

The domain name for the Base DN when searching the Schema will always be for the root domain of the forest.

Bind DN

The bind DN is the user on the external LDAP server permitted to search the LDAP directory within the defined search base. Most of the time, the bind DN will be permitted to search the entire directory.

Bind, which is rather like logging on.

The role of the bind DN is to query the directory using the LDAP query filter and search base for the DN (distinguished name) for authenticating users. When the DN is returned, the DN and password are used to authenticate the user.

Examples :

  • Possible Active Directory bind DNs
    • cn=administrator,cn=Users,dc=domain,dc=com - DN format
    • [email protected] - User principal name format
  • OpenLDAP
    • cn=root,dc=domain,dc=com

If the bind DN and password are blank, anonymous binding is assumed. For security reasons, not all LDAP servers allow anonymous binding. These fields are optional for LDAP V3, but required for LDAP V2, because LDAP V2 does not support anonymous binding.


Discover More
Ldap Member Attribute
(Weblogic|OBIEE) - Active Directory (ADSI) Configuration

This article show how to configure Weblogic in order to let OBIEE authenticate against Active Directory. Once the AD domain is recognise as a valid user store to authenticate Oracle BI, users will be...
Bip Ldap Adsi Config
BIP - Security Configuration with the LDAP capabilities of Active Directory

Ldap configuration for Go to the Admin tab > Security Configuration > Ldap configuration and fill the parameters fields with the values. More information on the parameters : In our case we filter...
Jxplorer Ldap
Client tools

You can query a ldap directory with the help of ldap client tool such as below jxplorer Apache Directory Studio ...

The Lightweight Directory Access Protocol () is an application protocol for querying and modifying directory services running over TCP/IP. It's a lightweight replacement (complement) for X500 Directory...
LDAP - Data Interchange Format (LDIF)

LDAP Data Interchange Format (LDIF) is a file format Each line contains a variable name, a colon, and a space followed by a value for the variable. where: variable sn variable cn LDAP...
Ldap Connect
LDAP - LDP Client (Windows)

You can search in a Ldap application as in using LDP, which is included in Microsoft Windows Server™ 2003 and Windows® 2000 Server...
Obiee Bi Server Ldap Server
OBIEE 10G - How to configure BI Server against the LDAP of ADSI ?

This article show how to configure an Oracle BI Server to authenticate against Active Directory. In the Oracle BI Administration Tool, the CN user used for the BIND DN in the LDAP Server section...

Share this page:
Follow us:
Task Runner