This glossary defines terms commonly used when working with LDAP.

base DN.  The distinguished name (DN) that identifies the starting point of a search.

For example, if you want to search all of the entries that under the "ou=People,o=Airius.com" subtree of the directory, "ou=People,o=Airius.com" is the base DN.

computed attribute.  An attribute with values that are generated by the Netscape Directory Server front-end (these values are not stored in the back-end database).

continuation reference.  See search reference.

control.  LDAP controls are specified as part of the LDAP v3 protocol. A control provides the means to specify additional information for an operation. Clients and servers can send controls as part of the requests and responses for an operation.

DIT.  The hierarchical organization of entries that make up a directory. DIT stands for "Directory Information Tree."

DSA.  An X.500 term for a directory server. DSA stands for "Directory System Agent."

DSE.  An entry containing server-specific information. DSE stands for "DSA-specific entry." Each server has different attribute values for the DSE.

extended operation.  An extension mechanism in the LDAP v3 protocol. You can define extended operations to perform services not covered by the protocol. The extended operation mechanism specifies the means for an LDAP client to request a custom operation (not specified in the LDAP protocol) from an LDAP server.

operational attributes.  Attributes that are used by servers for administering the directory. For example, creatorsName is an operational attribute that specifies the DN of the user who added the entry. Operational attributes are not returned in any search results unless you specify the attribute by name in the search request.

referral.  Refers an LDAP client to another LDAP server. An LDAP server can be configured to send your client a referral if your client requests a DN with a suffix that is not in the server's directory tree (for example, if the directory includes entries under "o=Airius.com" and your client requests an entry under "o=AiriusWest.com").

Referrals contain LDAP URLs that specify the host, port, and base DN of another LDAP server.

Note that referrals are not the same as (but are similar to) search references. A search reference is returned as part of the results of a search; a referral is returned when the base DN of a search (or the target DN of any other LDAP operation) is not part of the LDAP server's directory tree.

referral hop limit.  The maximum number of referrals that your client should follow in a row. For example, suppose your client receives a referral from LDAP server A to LDAP server B. After your client follows the referral to LDAP server B, that server sends you a referral to LDAP server C, which in turn refers you to LDAP server D. Your client has been referred 3 times in a row. If the referral hop limit is 2, the referral hop limit has been exceeded.

root DSE.  An entry (a DSE) that is located at the root of the DIT.

search reference.  Also known as continuation references, search result references, or smart referrals. A search reference is an entry in the directory that refers to another LDAP server (the reference is in the form of an LDAP URL).

Search references are returned in search results along with entries found in the search. (A referral, on the other hand, is returned before searching through any entries. A referral is returned if the base DN does not have a suffix that is handled by the server.)

search result reference.  See search reference.

server plug-in.  The Netscape Directory Server 3.0 supports a plug-in interface that allows you to extend the functionality of the server. You can write plug-ins that handle extended operations or SASL authentication requests.

smart referral.  See search reference.

subschema entry.  Entry containing all the schema definitions (definitions of object classes, attributes, matching rules, and so on) used by entries in part of a directory tree.