What is the Directory Information Tree (DIT), and how are entries arranged in it?

The DIT is the tree in which a directory server stores its objects: one root (for example the organisation, o=acme) at the top, branches such as countries, departments, People and Groups below it, and individual entries as the leaves.

* A DIT for the company ACME: each entry's DN is its own RDN plus the DN of its parent. *

Related data is stored in LDAP objects (entries), and these are arranged hierarchically:

• The root is the topmost object. A company directory might use the organisation itself, o=acme, as the root (also called the suffix or naming context).
• Below it, containers structure the tree, typically by geography (c=de, c=at), by organisational unit (ou=webdesign) and by object type (ou=People, ou=Groups).
• Leaf entries are the real objects: people, groups, devices, applications.

People can live in any branch below the root (ou=People,...,o=acme) and groups in other branches (ou=Groups,...,o=acme). The tree shape matters in practice: searches start at a node and can be limited to its subtree, access rights are often granted per subtree, and branches can be replicated or delegated to different administrators.

Go deeper:

• RFC 4512, Section 2.1: The Directory Information Tree — the normative description of the DIT and entries.
• LDAP.com: Basic LDAP concepts — entries, DNs, attributes and the tree, explained with examples.