H3C S5830V2 Security Configuration Manual page 24

1. An LDAP client uses the LDAP server administrator DN to bind with the LDAP server, establishes a
connection to the server, and obtains the right to search.
2. The LDAP client uses the username in the authentication information of a user to construct search
conditions, searches for the user in the specified root directory of the server, and obtains a user DN
list.
3. The LDAP client uses each user DN in the obtained user DN list and the user's password to bind
with the LDAP server. If a binding succeeds, the user is a legal user.
The LDAP authorization process is similar to the LDAP authentication process, except that the client
obtains the authorization information and the user DN list at step 2 in the work flow.
If the authorization information meets the authorization requirements, the authorization process
•
ends.
If the authorization information does not the authorization requirements, the client sends an
•
administrator bind request to the LDAP server to obtain the right to search for authorization
information about users on the user DN list.
Basic LDAP packet exchange process
The following example illustrates how the basic packet exchange process goes on during LDAP
authentication and authorization for a Telnet user.
Figure 7 Basic packet exchange process for LDAP authentication of a Telnet user
Host
1) The user logs in by Telnet
10) The user logs in successfully
The basic packet exchange process is as follows:
1. A Telnet user initiates a connection request and sends the username and password to the LDAP
client.
2. Upon receiving the request, the LDAP client establishes a TCP connection with the LDAP server.
3. The LDAP client uses the administrator DN and password to send an administrator bind request to
the LDAP server to obtain the right to search.
LDAP client
2) Establish a TCP connection
3) Administrator bind request
4) Bind response
5) User DN search request
6) Search response
7) User DN bind request
8) Bind response
9) Authorization
10
LDAP server