A Base Distinguished Name (Base DN) is the starting point in an LDAP directory tree from which a search begins, defining the organizational scope of a query. Directory clients – including Versa’s LDAP authentication profiles – pair it with a Bind DN to authenticate, then search only the subtree the Base DN designates.
Key takeaways
- A Base DN sets where in the LDAP directory tree a search begins.
- It scopes queries – entries below it are reachable, entries outside are not.
- Base DNs commonly sit at the domain root or a specific department OU.
- LDAP authentication profiles require a Base DN alongside a Bind DN.
- A wrong Base DN makes user and group lookups return nothing.
On this page: Why it mattersHow it worksCommon Base DN scopesBase DN & VersaFAQ
Why is a Base DN important?
An LDAP query has to start somewhere. A directory tree can hold thousands of users, groups, and service accounts spread across many organizational units, and without a defined starting point a search either has no scope at all or defaults to the entire tree. The Base DN is what fixes that: it tells the directory server exactly which branch of the tree a search is allowed to walk.
That scoping matters for two practical reasons. Performance is one – a search rooted at a narrow OU returns faster than one that walks an entire domain. Security is the other: scoping a Base DN to only the OUs an application actually needs limits what that application’s directory queries can see, even before any access-control list is applied.
For administrators troubleshooting authentication, the Base DN is usually the first thing to check. If a directory-backed login fails or a group list comes back empty, an incorrectly scoped Base DN – pointed at the wrong OU, or missing a nested container – is one of the most common causes.
What is a Base DN?
A Base DN is written in standard LDAP Distinguished Name syntax: an ordered, comma-separated chain of attribute=value pairs read from most specific to least specific, ending at the directory root. A domain-root Base DN for versanetworks.com looks like DC=versanetworks,DC=com. A Base DN narrowed to one organizational unit looks like OU=Engineering,DC=versanetworks,DC=com.
At query time, a client combines the Base DN with a search filter (which attributes to match) and a search scope – base, one-level, or subtree – to define exactly which entries a query can return. The Base DN answers “where do I start”; the filter and scope answer “how far do I look, and for what.”
Administrators typically retrieve a domain’s Base DN directly from Active Directory, using tools like Active Directory Users and Computers (ADUC) or the command-line dsquery utility, rather than guessing at the domain’s DN structure.
Common Base DN scopes
Domain root. The broadest and most common scope: DC=versanetworks,DC=com. A search rooted here can, in principle, reach every user and group in the domain, subject to the querying account’s own permissions.
Organizational-unit scoped. Narrowing the Base DN to a specific OU, such as OU=Engineering,DC=versanetworks,DC=com, restricts a search to that container and everything nested beneath it. This is common when an application – an LDAP authentication profile, for example – should only ever authenticate one department’s users.
Nested-container scoped. Some AD environments place service or user accounts inside built-in containers, such as CN=Users, rather than a custom OU. A Base DN can point at these containers too, though CN= and OU= behave differently in AD tooling and are not interchangeable.
Which scope to use is a tradeoff: broader scopes need less maintenance as the directory grows, while narrower scopes limit exposure and query volume.
Base DN & Versa
Versa’s SSE Gateway uses LDAP-based authentication profiles to validate users against Active Directory or Open-LDAP servers, configured under Configure > Security Service Edge > User and Device Authentication > Profiles. The Base DN is a required field in that profile, entered alongside the Bind DN, Bind Password, and Domain Name, and it determines which part of the directory the gateway is permitted to search when validating a user or resolving group membership for policy enforcement.
To help administrators locate the right value, the step-by-step configuration guide includes an appendix on finding a domain’s Base DN using dsquery * domainroot -scope base on the AD server, alongside guidance on scoping it down to a specific OU when full-domain visibility is not wanted.
Frequently asked questions
What is the difference between a Base DN and a Bind DN?
A Base DN sets where a directory search begins and what part of the tree it can see. A Bind DN is the service-account identity a client authenticates as before it is allowed to search at all. An LDAP profile needs both: the Bind DN to log in, the Base DN to know where to look.
How do I find my Base DN in Active Directory?
The most common method is a domain-root query: run dsquery * domainroot -scope base on the AD server, which returns the domain’s root DN, such as DC=versanetworks,DC=com. Active Directory Users and Computers (ADUC) also shows the domain name, which converts directly into DN format.
Can a Base DN be scoped to something narrower than the domain root?
Yes. A Base DN can point at a specific organizational unit, such as OU=Engineering,DC=versanetworks,DC=com, which restricts a search to that OU and any containers nested beneath it. This is a common way to limit which users a given authentication profile is able to query and authenticate.
What happens if the Base DN in an authentication profile is wrong?
Directory searches scoped to the wrong branch return no matching entries, even if the target users or groups exist elsewhere in the tree. Symptoms include failed logins, empty user or group lists in policy rules, and authentication that appears misconfigured but is really a scoping problem.
Is a Base DN required for every LDAP authentication method?
Yes, for any authentication method that queries a directory server – LDAP against Open-LDAP or Active Directory – a Base DN is a mandatory field. Non-directory methods, such as certificate-based or purely local authentication, do not use a Base DN at all.
More on Base DN
If you want to learn more, these are sources we trust.
| RFC 4511: LDAP – The Protocol | RFC 4514: LDAP String Representation of Distinguished Names |
|---|---|
| The IETF specification defining the LDAP search operation, including the baseObject parameter that a Base DN supplies. | The IETF standard defining the string syntax used to write a Distinguished Name, including a Base DN. |
Related terms
If you’re reading about Base DN, these are worth looking at next.
| Distinguished Name | Bind Distinguished Name | Authentication Profile |
|---|---|---|
| The unique, hierarchical name identifying a single entry in a directory; a Base DN sets the subtree a search may traverse to find one. | The service-account DN an LDAP client authenticates as before searching; Versa pairs it with the Base DN to look up users and groups. | The Versa configuration object – LDAP, SAML, or certificate-based – that defines how users authenticate; LDAP profiles require a Base DN. |