Every LDAP directory is organized as a single tree, formally called the Directory Information Tree (DIT). Every piece of data in the directory — every user, group, and computer — is a node in that tree.
At the top of the tree is a root, called the base DN (distinguished name), which usually represents an organization or domain. Under it, entries are grouped using containers, most commonly organizational units (OUs).
- dc=com
- dc=example
- ou=Users
- ou=Engineering
- cn=Jane Doe
- ou=Engineering
- ou=Groups
- cn=Admins
- ou=Users
- dc=example
In this tree:
dc=example,dc=comis the base DN — the root of everything below it.dcstands for "domain component," andexample.comis spelled out as two of them.ou=Usersandou=Groupsare organizational units — containers used purely to group related entries.ou=Engineeringnests further insideou=Users, showing that OUs can be nested arbitrarily deep.cn=Jane Doeandcn=Adminsare leaf entries — actual records, not containers.cnstands for "common name."
A few practical consequences follow directly from this structure:
- Search scope. When you search LDAP, you specify a base DN to search under and a scope (just that entry, one level down, or the whole subtree). Searching
ou=Engineering,...with subtree scope only returns entries inside Engineering — the tree shape is a built-in filter. - Access control. Many directories grant permissions based on where in the tree an entry lives (for example, "help desk can reset passwords for anyone under
ou=Contractors"). - Uniqueness. No two entries can have the exact same distinguished name, because the DN encodes the entry's full path from the root. That's the subject of the next page: Distinguished names.
Note
Organizational units are the most common container, but you'll also see cn= used as a container in some server-generated paths (like cn=Users in a fresh Active Directory install) and dc= repeated multiple times for multi-label domains such as dc=corp,dc=example,dc=com.
Active Directory derives the base DN directly from the Windows domain name. A domain named corp.example.com has the base DN dc=corp,dc=example,dc=com. This comes up constantly when configuring LDAP clients against Active Directory, which is covered in depth in LDAP in Active Directory.
Base DN Helper
Convert between a domain name and its base DN.
Next, we'll zoom into a single node in this tree and look at exactly how its name — its distinguished name — is constructed: Distinguished names.