What is LDAP?

LDAP stands for Lightweight Directory Access Protocol. Applications use the open protocol to search, read and modify structured entries in a directory. Such directories commonly contain users, groups, devices, email addresses or technical configuration. LDAP defines access to this data; it is neither a specific database nor automatically a particular product.

How is an LDAP directory structured?

Entries form a hierarchical Directory Information Tree. Every entry has attributes and a unique Distinguished Name (DN). The DN uid=anna,ou=people,dc=example,dc=com, for example, identifies the entry uid=anna in the organizational unit people below example.com. Its first component is the Relative Distinguished Name (RDN). A schema defines which object classes and attributes an entry may or must contain.

How does a client communicate with LDAP?

A client opens a connection and usually starts with a Bind operation. It can then search, compare, add, modify or delete entries as far as its permissions allow. A search combines a base DN, search scope, filter and requested attributes. The client closes the session with Unbind. LDAP also supports extensions and controls, including paged search results.

LDAP commonly uses TCP port 389. The connection should be protected with StartTLS or established as LDAP over TLS, commonly called LDAPS on port 636. The name or port alone does not provide security: the client must require TLS, validate the certificate chain and hostname correctly, and must not continue in plaintext when negotiation fails.

Is LDAP an authentication method?

LDAP is often used during login but is primarily a directory access protocol. A simple Bind can let the server verify a username and password. Applications frequently search for a user's DN first and then bind with that DN. SASL mechanisms or, in Active Directory, Kerberos are alternatives. A successful Bind confirms an identity but does not decide what that identity may do in the application. Correct application-level authorization is still required.

How do LDAP and Active Directory differ?

Active Directory can therefore be accessed using LDAP, but LDAP and Active Directory are not interchangeable terms.

How is LDAP operated securely?

• Protect transport: Require TLS, validate certificates fully and never transmit simple Bind credentials over plaintext.
• Limit privileges: Give applications separate service accounts with a narrow search base, access to required attributes only and no unnecessary write rights.
• Control access: Reduce anonymous queries, publicly exposed directory information and administrative interfaces to what is necessary.
• Handle input safely: Escape user input according to LDAP syntax and avoid string concatenation in filters to prevent LDAP injection.
• Protect secrets: Keep Bind passwords out of source code, rotate them and preferably deliver them through secret management.
• Monitor: Record failed Bind attempts, unusually broad searches, bulk queries and changes to privileged groups.

Which mistakes are common?

Clients frequently accept arbitrary certificates, use one overprivileged shared service account or retrieve the entire directory tree as a precaution. Missing size and time limits can also enable expensive searches. Some applications trust a group attribute alone without handling nested groups, stale membership or application context correctly. Secure LDAP therefore requires both a hardened server configuration and a defensively implemented client.