🗂️LDAP

NEW

Also known as: Lightweight Directory Access Protocol

An open, vendor-neutral protocol for accessing and maintaining distributed directory services over IP networks.

DESCRIPTION

LDAP is a lightweight application protocol used to query and modify directory services such as organizational users, groups, and resources. It underpins authentication and authorization workflows across enterprise systems, commonly with Active Directory or OpenLDAP. LDAP defines operations like bind, search, add, modify, and delete, with schema-based entries identified by distinguished names. It supports referrals, access controls, and secure transport via TLS (LDAPS). LDAP remains foundational for identity integration and centralized access management.

ALTERNATIVE DEFINITIONS

Wikipedia

The Lightweight Directory Access Protocol (LDAP) is an open, vendor-neutral, industry standard application protocol for accessing and maintaining distributed directory information services over an Internet Protocol (IP) network.

Emphasizes openness, vendor neutrality, and directory information services.

Source

OpenLDAP

LDAP is a lightweight client-server protocol for accessing directory services.

Highlights client-server nature and focus on directory services.

Source

RELATED TERMS

Active Directory Kerberos Single Sign-On Identity Management X.500 Directory Service LDAPS RBAC SSSD

COMPETING TERMS

X.500 Directory Access Protocol (DAP) System for Cross-domain Identity Management

KNOWLEDGE AREAS

Data Security Infrastructure Data Integration & Interoperability Data Management

TARGET AUDIENCE

Security Architect DevOps Engineer Application Administrator IT Manager Software Developer Chief Information Security Officer Cybersecurity Engineer

EXTERNAL SOURCES

• Wikipedia - Lightweight Directory Access Protocol
• IETF RFC 4511 - LDAP v3 protocol specification.
• OpenLDAP - OpenLDAP Administrator’s Guide.
• Microsoft Learn - LDAP overview for Active Directory.

TOP QUESTIONS

What does LDAP primarily manage?

LDAP manages directory information like users, groups, devices, and credentials using schema-defined entries and distinguished names.

Category: Example

How is LDAP secured in production?

Use TLS (LDAPS), strong bind policies, access controls, and audited operations. Avoid cleartext passwords and enforce least privilege.

Category: Requirements

What is the difference between LDAP and Active Directory?

LDAP is a protocol; Active Directory is a directory service that implements LDAP (and other protocols) for identity and authorization.

Category: Misunderstanding

What are common mistakes with LDAP integration?

Incorrect DN formats, misconfigured referrals, weak bind credentials, and unencrypted connections are frequent integration problems.

Category: Mistakes

What risks arise with LDAP misconfiguration?

Unauthorized directory access, privilege escalation, and exposed credentials can result from insecure binds and ACLs.

Category: Risks

How does LDAP relate to Single Sign-On?

LDAP stores identities and groups used by SSO solutions, while SSO handles authentication flows often via SAML or OpenID Connect.

Category: Example

What is currently a hot topic around LDAP?

Migration to modern identity APIs and SCIM provisioning, while retaining LDAP for legacy and infrastructure integrations.

Category: Topic

How do you query LDAP directories?

Use search operations with filters (e.g., objectClass), specifying base DNs, scopes, and attributes to return.

Category: Example

Is LDAP outdated?

No; while newer protocols exist, LDAP remains vital for enterprise identity, legacy systems, and infrastructure automation.

Category: Opinion