Directory services (Active Directory, LDAP) in Cybersecurity - Mini Project: Build & Apply

Understanding Directory Services: Active Directory and LDAP

📖 Scenario: You are learning about directory services used in organizations to manage users and resources securely. Two common directory services are Active Directory and LDAP. This project will help you understand their basic structure and how they store information.

🎯 Goal: Build a simple representation of a directory service using a dictionary to store user information, then filter users based on a condition, and finally add a configuration setting to simulate access control.

📋 What You'll Learn

Create a dictionary named directory with user entries and their roles

Add a variable named access_level to set a minimum role for access

Use a dictionary comprehension to create a filtered dictionary allowed_users with users meeting the access level

Add a final key service_status to the directory dictionary indicating if the service is active

💡 Why This Matters

🌍 Real World

Directory services like Active Directory and LDAP are used in companies to manage who can access computers, files, and applications securely.

💼 Career

Understanding directory services is important for cybersecurity professionals to control user permissions and protect organizational resources.

1

Create the directory data structure

Create a dictionary called directory with these exact entries: 'alice': 'admin', 'bob': 'user', 'carol': 'guest', 'dave': 'user', and 'eve': 'admin'.

Cybersecurity

# Create the directory dictionary with user roles
# Your code here

Hint

Use curly braces {} to create a dictionary and separate each key-value pair with a comma.

2

Add access level configuration

Add a variable called access_level and set it to the string 'user' to represent the minimum role allowed access.

Cybersecurity

directory = {
    'alice': 'admin',
    'bob': 'user',
    'carol': 'guest',
    'dave': 'user',
    'eve': 'admin'
}
# Set the minimum access level
# Your code here

Hint

Assign the string 'user' to the variable access_level.

3

Filter users by access level

Create a new dictionary called allowed_users using dictionary comprehension. Include only users from directory whose role is either 'admin' or 'user' (roles equal to or higher than access_level). Use for username, role in directory.items() to iterate.

Cybersecurity

directory = {
    'alice': 'admin',
    'bob': 'user',
    'carol': 'guest',
    'dave': 'user',
    'eve': 'admin'
}
access_level = 'user'
# Create allowed_users dictionary with users having role 'admin' or 'user'
# Your code here

Hint

Use dictionary comprehension with for username, role in directory.items() and an if condition to filter roles.

4

Add service status to directory

Add a new key-value pair to the directory dictionary: set the key 'service_status' to the string 'active'.

Cybersecurity

directory = {
    'alice': 'admin',
    'bob': 'user',
    'carol': 'guest',
    'dave': 'user',
    'eve': 'admin'
}
access_level = 'user'
allowed_users = {username: role for username, role in directory.items() if role in ['admin', 'user']}
# Add 'service_status' key with value 'active' to directory
# Your code here

Hint

Use directory['service_status'] = 'active' to add the new key and value.

Practice

1. What is the primary purpose of directory services like Active Directory or LDAP?

easy

A. To store and organize information about users and resources on a network

B. To provide antivirus protection for computers

C. To manage internet browsing history

D. To encrypt email messages automatically

Solution

1. Step 1: Understand directory services function

   Directory services are designed to keep track of users, computers, and other resources in a network.

2. Step 2: Identify the correct purpose

   Among the options, only storing and organizing network information matches the role of directory services.

3. Final Answer:

   To store and organize information about users and resources on a network -> Option A

4. Quick Check:

   Directory services = store network info [OK]

Hint: Directory services manage network users and resources [OK]

Common Mistakes:

• Confusing directory services with security software
• Thinking directory services handle internet browsing
• Assuming directory services encrypt emails

2. Which of the following is the correct protocol used by Active Directory to query directory information?

easy

A. HTTP

B. SMTP

C. FTP

D. LDAP

Solution

1. Step 1: Recall Active Directory protocols

   Active Directory uses LDAP (Lightweight Directory Access Protocol) to query and update directory data.

2. Step 2: Match protocol to options

   Among the options, only LDAP is the directory query protocol; HTTP, FTP, and SMTP serve other purposes.

3. Final Answer:

   LDAP -> Option D

4. Quick Check:

   Active Directory uses LDAP [OK]

Hint: LDAP is the directory query protocol for Active Directory [OK]

Common Mistakes:

• Choosing HTTP which is for web traffic
• Confusing FTP with file transfer only
• Selecting SMTP which is for email sending

3. Consider this LDAP query filter: (objectClass=user). What does this filter do when querying a directory?

medium

A. Returns all objects that are users

B. Returns all objects that are computers

C. Returns all objects with no class

D. Returns all objects that are groups

Solution

1. Step 1: Understand LDAP filter syntax

   The filter (objectClass=user) selects directory entries where the objectClass attribute equals 'user'.

2. Step 2: Identify what objectClass=user means

   This means the query returns all user objects, not computers or groups.

3. Final Answer:

   Returns all objects that are users -> Option A

4. Quick Check:

   LDAP filter (objectClass=user) = user objects [OK]

Hint: objectClass=user filter selects user entries [OK]

Common Mistakes:

• Thinking it returns computers or groups
• Misreading the filter syntax
• Assuming it returns all objects regardless of type

4. You wrote this LDAP query filter to find all groups: (objectClass=group). But it returns no results. What is the most likely reason?

medium

A. The filter syntax is incorrect and should be (objectClass==group)

B. You need to use (objectCategory=group) instead for better results

C. The directory does not contain any group objects

D. LDAP does not support filtering by objectClass

Solution

1. Step 1: Check LDAP filter syntax

   The syntax (objectClass=group) is correct, so syntax error is unlikely.

2. Step 2: Understand objectClass vs objectCategory

   In Active Directory, objectCategory is often more reliable for filtering groups than objectClass.

3. Step 3: Identify the best filter

   Using (objectCategory=group) usually returns group objects correctly.

4. Final Answer:

   You need to use (objectCategory=group) instead for better results -> Option B

5. Quick Check:

   Use objectCategory=group for groups [OK]

Hint: Use objectCategory=group to reliably find groups [OK]

Common Mistakes:

• Assuming no groups exist in directory
• Using double equals in LDAP filter
• Believing LDAP can't filter by objectClass

5. You want to create an LDAP query to find all users who are members of a specific group named "SalesTeam". Which filter correctly combines these conditions?

hard

A. (&(objectClass=group)(memberOf=SalesTeam))

B. (|(objectClass=user)(memberOf=SalesTeam))

C. (&(objectClass=user)(memberOf=CN=SalesTeam,OU=Groups,DC=example,DC=com))

D. (objectClass=user)(memberOf=SalesTeam)

Solution

1. Step 1: Understand LDAP filter operators

   The & operator means AND, | means OR. To find users who are members of a group, both conditions must be true.

2. Step 2: Analyze each filter

   (&(objectClass=user)(memberOf=CN=SalesTeam,OU=Groups,DC=example,DC=com)) correctly uses AND to combine user objects with the memberOf attribute matching the full distinguished name of the group. (|(objectClass=user)(memberOf=SalesTeam)) uses OR, which is incorrect. (objectClass=user)(memberOf=SalesTeam) lacks an operator to combine conditions. (&(objectClass=group)(memberOf=SalesTeam)) looks for groups, not users.

3. Final Answer:

   (&(objectClass=user)(memberOf=CN=SalesTeam,OU=Groups,DC=example,DC=com)) -> Option C

4. Quick Check:

   Use AND (&) with objectClass=user and full memberOf DN [OK]

Hint: Use & to combine user and memberOf filters with full DN [OK]

Common Mistakes:

• Using OR instead of AND to combine filters
• Not using full distinguished name in memberOf
• Filtering groups instead of users