• Glossary
  • What is LDAP (Lightweight Directory Access Protocol)?

Security glossary

What is LDAP (Lightweight Directory Access Protocol)?

LDAP (Lightweight Directory Access Protocol) is an application protocol that lets clients search, read and modify entries in a hierarchical directory service over an IP network. It is defined by the IETF, commonly used to authenticate users and look up identity data, and runs over TCP.

Let's simplify your DDI
Abstract isometric UI showing network ranges, usage bars, region names (EMEA/APAC), and a purple "Deploy" button
Key takeawaysKey takeaways are generated with AI assistance. Because automated summaries can occasionally contain errors or miss important context, always refer to the full blog post for complete information.

LDAP (Lightweight Directory Access Protocol) is an application protocol that enables clients to search, read, and modify entries in hierarchical directory services over TCP/IP networks, commonly used for user authentication and identity data lookup in enterprise environments. Organizations rely on LDAP as a central directory service accessed by VPN gateways, web applications, mail systems, and network devices, making directory availability and performance critical to enterprise operations since outages can block logins across the entire organization. Security and operational reliability depend on proper configuration including encrypted connections via TLS, least-privilege service accounts, certificate validation, redundant servers, and protection against common threats such as credential exposure and LDAP injection attacks.

  • LDAP operates on TCP port 389 with optional StartTLS encryption or port 636 for LDAPS, and uses a client-server model where clients authenticate via simple bind or SASL mechanisms before sending search, add, modify, or delete operations.
  • Common operational failures stem from certificate validation errors, expired service account credentials, stale DNS records, and single-server dependencies that can be mitigated through redundant directory servers and proper monitoring of bind response times.
  • Security risks include cleartext password transmission on unencrypted port 389, anonymous binds that leak user data, LDAP injection vulnerabilities from unescaped filter characters, and overly broad access controls that expose sensitive directory information.

LDAP at a glance

AttributeValue
Full nameLightweight Directory Access Protocol
CategoryNetwork protocol
Defined inRFC 4511, with the current technical specification set in RFC 4510
Protocol and portTCP port 389 for LDAP and StartTLS, TCP port 636 for LDAP over TLS (LDAPS)
OSI layerLayer 7 (application)
Primary useAuthenticating users and querying identity and resource information in a directory
Related termsActive Directory, Kerberos, TLS, single sign-on, DNS SRV record

How LDAP works

LDAP uses a client-server model in which a client opens a connection to a directory server, authenticates, and then sends operations that the server answers with results. Directory data is organized as a tree of entries, each identified by a distinguished name.

  1. Connect: The client opens a TCP connection to the directory server, typically on port 389, or port 636 when TLS is used from the start.
  2. Secure the session: On port 389 the client can issue the StartTLS operation to upgrade the connection to an encrypted one before sending credentials.
  3. Bind: The client sends a bind request to authenticate. A simple bind sends a distinguished name and password, while SASL binds support other mechanisms. An anonymous bind sends no credentials.
  4. Send operations: The client sends requests such as search, compare, add, modify, delete or modify DN. A search specifies a base entry, a scope, a filter and the attributes to return.
  5. Receive results: The server returns matching entries and a result code for each request. Multiple requests can be outstanding on one connection.
  6. Unbind: The client sends an unbind request and the connection closes.

The steps above do not cover how clients find servers or how data stays consistent. Clients often locate servers through DNS SRV records, and directory servers typically replicate data among themselves, though replication is not part of the core protocol. Access to entries and attributes is governed by server-side access control rules.

Why LDAP matters in enterprise networks

LDAP is the common way applications reach a central directory. VPN gateways, web applications, mail systems, network devices and Linux hosts often query it to verify a user or read group membership. Because so many systems depend on one directory, an outage or slow response can block logins across the whole organization.

Security depends heavily on configuration. A simple bind sends the password in clear text unless the session is protected with TLS, so unencrypted LDAP on port 389 exposes credentials to anyone who can capture traffic. Anonymous binds, overly broad service accounts and loose access controls can leak user and group data. Applications that build search filters from user input without escaping it are open to LDAP injection, which RFC 4515 addresses by defining how special characters in filter values must be escaped.

Operational problems usually come from certificates and discovery. Expired or mismatched server certificates cause TLS failures that look like authentication errors, and clients that rely on stale DNS records or a single hard-coded server fail when that host is retired. Teams that manage LDAP well use encrypted connections, least-privilege service accounts, monitored response times and redundant servers.

LDAP vs Active Directory

LDAP is a protocol for accessing directory data, while Active Directory is a directory service that stores identity data and supports LDAP among other protocols. What is Active Directory?

AttributeLDAPActive Directory
TypeApplication protocolDirectory service
RoleDefines how clients query and modify directory entriesStores users, groups and computers and enforces policy
AuthenticationSimple and SASL bindsCommonly uses Kerberos, and also accepts LDAP binds
StandardizationDefined by the IETFImplementation with its own extensions

Common LDAP issues

Applications configured for port 389 without StartTLS send the bind DN and password unencrypted, which shows up in packet captures and audits. Switch to StartTLS or port 636 and reject simple binds on unprotected sessions.

Clients report errors such as an untrusted issuer or a name mismatch when the directory server certificate is signed by a CA the client does not trust, has expired, or lacks the hostname used in the connection. Connecting by IP address instead of the certificate name is a frequent cause.

A search returns no entries or the wrong ones because the search base, scope or filter does not match the directory tree. Login fails even though the credentials are correct, often after a directory restructure.

An application bind account with an expired or changed password retries repeatedly and locks out, which breaks every login that depends on it. Monitoring bind failures from the service account catches this early.

Pointing clients at one directory server means a restart or network fault blocks logins everywhere. Use several servers or a load balanced name, and make sure DNS records for them resolve correctly.

See how unified DDI simplifies network operations

Manage DNS, DHCP and IP addresses from one platform with automation, visibility and control built in.

Talk to us

LDAP FAQ

Related terms

Article

Active Directory

A Microsoft directory service for Windows domain networks that is included in most Windows Server operating systems as a set of processes and services.

Learn more
Article

AAA (Authentication, Authorization and Accounting)

Refers to a family of protocols that mediate network access.

Learn more
Article

Transport layer security (TLS)

A cryptographic protocol to provide communications security over a computer network.

Learn more
Article

TCP

A protocol that provides reliable, ordered, and error-checked delivery of bytes between applications running on hosts communicating via an IP network; part of the TCP/IP suite.

Learn more
Article

Remote Authentication Dial-In User Service (RADIUS)

A client/server protocol and software that enables remote access servers to communicate with a central server to authenticate dial-in users and authorize their access to the requested system or service.

Learn more
Article

DNS – Domain Name System

A hierarchical naming system that enables communication across devices in a network.

Learn more
Article

GUID (Globally Unique Identifier)

A128-bit number used to identify information in computer systems, typically in software created by Microsoft.

Learn more
Browse the full glossary