LDAP Directory Tree Diagram

LDAP directory tree

An LDAP directory tree is organized around a base distinguished name, often a domain-style DN such as dc=example,dc=com. Below it, organizational units group entries by their purpose: people, groups and service accounts are common starting points. User entries, group entries and application bind accounts then sit under their respective organizational units. A diagram makes the hierarchy easier to explain during onboarding, migration planning and access reviews. It should reflect the naming conventions and actual distinguished names used in the directory, not just a generic example. Directory schemas vary between OpenLDAP, Active Directory and other services, so capture the units and object classes that matter to the systems using the directory.

類型 實體結構圖標準 Tier-based ownership hierarchy引擎 schematex-entity更新時間 2026/9/24

需求

“Create an LDAP directory tree with base DN dc=example,dc=com, People, Groups and Service Accounts organizational units, and entries for alice, developers, and app-bind.”

接著試試Add an ou=Computers organizational unit.Add uid=bob under People.

這張圖裡有什麼

看懂背後的決策。

01Base DN

Start at the directory root.

02Organizational units

Group entries by purpose.

03User entries

Place people below the People OU.

04Groups and binds

Show group and service-account entries.

Use it to document a directory's intended hierarchy; replace the sample DNs with the names in the actual directory.

瀏覽所有實體結構圖範本 →

常見問題

What is the base DN?

The base distinguished name is the directory root from which LDAP searches and subordinate entries are organized.

What is an organizational unit?

An organizational unit, or OU, is a container that groups related directory entries, such as users or service accounts.

Why separate service accounts?

A separate OU makes application bind accounts easier to identify, manage and review independently from human users.