Users and groups

Almost every real-world use of LDAP eventually comes down to two kinds of entries: users and groups. The concepts are simple, but the exact attribute names vary by directory implementation.

User entries

A user entry represents a person (or sometimes a service account) who can authenticate. Typical attributes include:

Attribute	Meaning
`cn`	Common name (usually the full display name)
`sn`	Surname
`givenName`	First name
`mail`	Email address
`uid` / `sAMAccountName`	Login username (OpenLDAP vs. Active Directory)
`userPassword`	Password hash (OpenLDAP; Active Directory stores this internally and never exposes it over LDAP)

Group entries

A group entry represents a named collection of members — a team, a role, or an access grant. Groups typically list their members directly:

ldif

dn: CN=Engineering,OU=Groups,DC=example,DC=com
objectClass: groupOfNames
cn: Engineering
member: CN=Jane Doe,OU=Users,DC=example,DC=com
member: CN=Alex Chen,OU=Users,DC=example,DC=com

Two directions of membership

There are two complementary ways to represent "who is in this group," and different directories emphasize different ones:

Forward (group → members). The group entry lists a member (or memberOf on some servers, uniqueMember for groupOfUniqueNames) attribute containing the DN of each member. Finding a group's members means reading that one attribute.
Reverse (member → groups). The user entry lists a memberOf attribute containing the DN of every group it belongs to. Finding a user's groups means reading that one attribute on the user, instead of searching every group.

Active Directory maintains both automatically — member on the group and a computed, read-only memberOf on the user. OpenLDAP maintains member natively and typically requires the memberof overlay module to be enabled to get the reverse attribute for free. Without it, finding a user's groups means searching all groups for a member value matching the user's DN.

Note

Group membership can also be nested — a group can be a member of another group. Whether nested membership is resolved automatically (as it is in Active Directory, up to a depth limit) or has to be walked manually depends on the directory server.

Checking membership in practice

Two common patterns:

"List this user's groups" — read memberOf on the user entry (or search groups for member equal to the user's DN if memberOf isn't available).
"Is this user in group X" — either check whether memberOf contains group X's DN, or run a filtered search for the group with a member clause for the user's DN.

See Groups with ldapjs for working code for both patterns.

What's next

The last concept before moving to Node.js is making sure your connection is actually secure: LDAPS and TLS.