Directory service

As explained in Data Pipelines with Apache Airflow, Second Edition

A directory service is a storage system that manages information about resources such as users and services and supports querying that information.

A directory service is a storage system for information about resources such as users and services. Connecting Airflow to one avoids maintaining a separate user database: user information is fetched from the directory during login. LDAP is the protocol commonly used to query these services. section 16.3

One account for multiple applications

A company can store an employee account once in a directory service such as Microsoft Entra ID or OpenLDAP. Airflow accesses that account through LDAP, allowing the employee to connect to multiple applications without another Airflow-specific password. section 16.3

Directory services favor high volumes of reads over frequent updates. Their data resembles a phone book: user accounts, devices, printers, and network shares are requested often but usually change less often than transactional records such as payments. Entries are organized in a hierarchical directory information tree (DIT). Each entry represents an entity, stores attributes as key-value pairs, and has a unique distinguished name (DN). section 16.3.1

LDAP provides operations for querying and managing directory entries:

• Search returns entries matching criteria, such as a user identifier. section 16.3.1
• Bind authenticates as a user after the initial anonymous connection. section 16.3.1
• Add, modify, delete, and modify DN create, edit, remove, or rename entries. section 16.3.1
• Compare checks an attribute value; abandon cancels an operation; unbind closes the connection; extended requests depend on the directory service. section 16.3.1

Searching a directory

ldapsearch -b "dc=apacheairflow,dc=com" ldapsearch -b "dc=apacheairflow,dc=com" "(uid=bsmith)" The first command searches beneath a domain-based directory root; the second narrows the search to the entry whose uid is bsmith. section 16.3.1

Figure 16.9 Information in a directory service is stored in a hierarchical structure named DIT. Entries represent an entity such as a person and hold key-value attributes about the entity.

Use the directory tree illustration to inspect how hierarchical entries represent entities and their attributes. section 16.3.1

Table 16.2 Overview of LDAP operations

LDAP operation	Description
Abandon	Aborts a previously requested operation
Add	Creates a new entry
Bind	Authenticates as a given user. Technically, the first connection to a directory service is anonymous. Then the bind operation changes the identity to a given user, which allows you to perform certain operations on the directory service.
Compare	Checks whether a given entry contains a given attribute value
Delete	Removes an entry
Extended	Requests an operation that isn’t defined by the LDAP standard but is available on the directory service (depending on the type of directory service you’re connecting to)
Modify DN	Changes the DN of an entry
Modify	Edits attributes of an entry
Search	Searches and returns entries that match given criteria
Unbind	Closes the connection to a directory service

Use the LDAP operations table as a compact reference for authentication, searching, entry changes, and connection management. section 16.3.1

How Data Pipelines with Apache Airflow, Second Edition covers it

How deep it goes

Defines directory structure, entry identity, LDAP operations, and read-heavy trade-offs without detailing Airflow connection configuration.

Examples

Uses Airflow login, Entra ID, OpenLDAP, employee accounts, hierarchical entries, and ldapsearch commands with base and uid filters.

What you can do after

Evaluate/understand when directory services suit read-heavy account storage and how LDAP identifies and queries entries.

How it connects

Relates directory services to LDAP, directory information trees, distinguished names, relational databases, and SQL.

liveBookmanning.com

Read Data Pipelines with Apache Airflow, Second Edition on liveBook Get the book at manning.com

Related concepts

• Lightweight Directory Access Protocolused by · The Lightweight Directory Access Protocol is a network protocol for accessing, querying, and managing hierarchically organized directory information.
• provisioningused by · Provisioning is the process of preparing resources by creating, allocating, or configuring them so they are available for use.
• identity providerused by · An identity provider is a system that authenticates users or other entities and supplies identity information or authentication assertions to relying applications and services.

This explainer was generated by Manning's knowledge graph from the text of Data Pipelines with Apache Airflow, Second Edition. The section links point to the parts of the book it draws on.