LDAPviewer is a Java based browser, editor and DIT manipulation utility for LDAP and DSML enabled Servers. It is based on a fork of JXPlorer (substantially refactored) and will be Open Sourced (subject to conditions defined by its License) on a public repository during 2018.
Detailed functionality and access to the on-line help.
LDAP is not an easy system to work with. Knowledge thresholds tend to be very high even for casual usage such as simple data viewing, editing or browsing. The DN display format tends to look ugly or complex and even the casual user can quickly be exposed to huge numeric strings (OIDs) that make even IPv6 addresses look quaintly simple. In many respects this has limited the widespread use of LDAP outside a relatively narrow field of implementation, such as single sign-on and authentication, where its relative complexity, and ugliness, is offset by the reward of increased security management and where few casual users dare to tread.
This is unfortunate since LDAP has huge potential outside of these narrow fields of implementation.
Aquisition of LDAP knowledge can be a difficult journey with vast amounts of complex technical information being thrown indiscriminately at, and consequently tending to overwhelm, the new user.
The LDAPviewer (LV) Project was started with the following, user specific, sets of objectives:
The LDAP interface that is conventially presented to the end user tends to look complex (or ugly as you prefer) or as a mimimum daunting to all but hardened professionals. In many cases this has limited the implementation of LDAP even in such historically slam dunk-application such as white page extensions to basic authentication.
Provide a high quality LDAP/DSML Viewer or Browser with an easy to use (intuitive) interface that hides as much LDAP detail as practical.
Provide data display and editing options tailored to the end-user using a familiar HTML-form style interface (other formats are available for the more experiended user). HTML-forms can substitute sensible terminology (why should the user enter data in a field labelled sn if Family Name or Surname is more commmonly understood in a local context), add explantory text in-situ, limit displayed attributes, provide visual clues and a host of other features. While LDAPviewer provides a number of forms for common objectClasses these would typically be used as a basis for customization by site administrators for distribution to particular classes of end users.
Provide Connection Profiles as a means of storing connection information for reuse. Connection Profiles, as well as containing connection information can also be used to tailor or limit access to specific features or data sets. LDAP Access becomes point and click on named Connection Profile(s).
Allow site administrators to create Connection Profiles that can be locally distributed with LDAPviewer requiring the casual, or task-specific, user to simply select a site-specific named Connection Profile(s) and (optionally) enter any required credentials. Note: The Connection Profile includes the base DN such that tailored views (virtual DITs) and minimal access permissions are required for selected user groups or individual users. LDAPviewer cannot, and therefore will not, attempt to access below the base DN.
Provide a rich set of HTML template features (using standard HTML with LDAPviwer specific extensions) that allow administrators to build and distribute HTML forms tailored to end user access.
Return attribute sets and searches can be saved as named items and distributed locally with LDAPviewer.
Plug-in architecture. LDAPviewer is designed to host locally developed (or site specific) plug-ins that can further simplify end user access.
LDAP development and implementation has a high knowldege threshold. This both acts as a barrier to more widespread usage and increases investment in implementation due to extended learning lead times. LDAPviewer attempts to reduce the unedifing right of passage to a minimum.
Provide drill down features (mostly invoked by right clicking) to allow display of ASN.1 definitions of selected objects.
Provide a help service which provides both LDAPviewer functional information and basic LDAP information. A Help Info service allows custom access to technical or extended documentation. Learn while using is the target philosophy.
Searches can be constructed manually or using a search constructor which can significantly simplify construction of compound searches. Search results are displayed in a separate Tree structure thus allowing creation of Virtual DITs which can be navigated, edited and manipulated.
Connection Profiles may be configured to display concurrent access to one or more (up to 5) of the schema, RootDSE and any On-Line Configuration (OLC) feature including any necessary credential information.
Administrators or LDAP developers have typically undergone the painful LDAP learning phase and have accumulated knowledge of various tools (GUI and command line) that will let them do their job effectively. The critical factor here is how efficient such tools are.
LDAP object syntax and current support state may be viewed by name, OID or right-clicking in an editor. LDAPviewer mains a cumulative set of objects based on all connected servers.
Connection Profiles may be optionally configured to display concurrent access to the RootDSE including any necessary credential information.
Editing changes may be actioned immediately or saved as a modify LDIF for archival or subsequent application to, for example, a live server.
Searches may entered manually or by using a Search constructor. Compound searches may be constructed using a unique tabular format from individual expressions and/or combining existing searches and saved as named entities for subsequent re-use.
Search results are displayed in a separate Search DIT (a virtual DIT) and navigated independently. Return attribute lists, alias dereferencing and Referral handing can be uniquely configured. LDIF operations in the Search DIT use the properties defined for the search.
LDIF export operations allow the DN to be modified during export.
Entries and branches may be cut, copied or pasted at will.
Connection Profiles may be optionally configured to display concurrent access to a Secondary DIT supporting configuration or monitoring features (such as those of OpenLDAP, ApacheDS and others). The DN to access these feature together with capture of any necessary credential information in the Connection Profile provides maximum flexibility for a wide range of LDAP servers.
The Secondary DIT feature may also be used to support any other service on the same host as the Primary DIT, for example concurrent access to a second DIT or a another DIT view based on a different base DN.
Multiple windows may be opened to provide concurrent access to multiple servers.
Schema and Schemax (schema extension) files may be used to supply extended site specific information on the use or limitation of any particular attribute or objectClass.
Standard help files use HTML format and may be edited locally with site specific content. An administrators HTML Help kit provides the help files (using Apache SSI includes and an expansion utility) to allow easy replacement of styling and textual context for site specific use.
Security files of type .pem, .der, .crt, .pfx, .pb7, .p12 and others may be analyzed in text, binary and ASN.1 format.
LDAP, LDAPS (TLS/SSL) and StartTLS options may be configured.
Certificates may be optionally validated using the normal Java Trusted keystore, a user defined keystore, manually or certificate validation may be bypassed entirely.