Lightweight Directory Access Protocol - LDAP URLs

LDAP URLs

An LDAP URL format exists, which clients support in varying degrees, and servers return in referrals and continuation references (see RFC 4516):

ldap://host:port/DN?attributes?scope?filter?extensions

Most of the components described below are optional.

• host is the FQDN or IP address of the LDAP server to search.
• port is the network port (default port 389) of the LDAP server.
• DN is the distinguished name to use as the search base.
• attributes is a comma-separated list of attributes to retrieve.
• scope specifies the search scope and can be "base" (the default), "one" or "sub".
• filter is a search filter. For example (objectClass=*) as defined in RFC 4515.
• extensions are extensions to the LDAP URL format.

For example, "ldap://ldap.example.com/cn=John%20Doe,dc=example,dc=com" refers to all user attributes in John Doe's entry in ldap.example.com, while "ldap:///dc=example,dc=com??sub?(givenName=John)" searches for the entry in the default server (note the triple slash, omitting the host, and the double question mark, omitting the attributes). As in other URLs, special characters must be percent-encoded.

There is a similar non-standard ldaps: URL scheme for LDAP over SSL. This should not be confused with LDAP with TLS, which is achieved using the StartTLS operation using the standard ldap: scheme.