LDAP
By IETF
LDAP, the Lightweight Directory Access Protocol, is an open standard for reading and writing information stored in a hierarchical directory service, most commonly user accounts, groups, and organizational data. It defines how client…
Definition
LDAP, the Lightweight Directory Access Protocol, is an open standard for reading and writing information stored in a hierarchical directory service, most commonly user accounts, groups, and organizational data. It defines how client applications query and modify entries over a network, and it remains the underlying protocol that systems like Microsoft Active Directory use to authenticate users and look up organizational structure.
Overview
LDAP addresses the need for a fast, standardized way to look up and organize information about people, devices, and resources within a network, structured as a tree rather than a flat database table. It emerged as a lighter alternative to the earlier X.500 directory access protocol, stripped down to run efficiently over TCP/IP, which made it practical for everyday operations like checking whether a username and password combination is valid or retrieving a list of members in a department group. Mechanically, an LDAP directory organizes entries in a tree structure called the Directory Information Tree, where each entry has a unique distinguished name built from attributes such as organizational unit, domain component, and common name. A client connects to an LDAP server, optionally binds with credentials to authenticate itself, and then issues operations like search, compare, add, modify, or delete against entries under a specified base. Authentication against LDAP typically works by performing a bind operation with a user's distinguished name and password; if the bind succeeds, the credentials are valid, which is the mechanism many legacy applications use to check logins against a central directory rather than maintaining their own user database. LDAP sits underneath higher-level identity systems rather than competing with them directly. Microsoft Active Directory, for instance, uses LDAP as one of its core protocols alongside Kerberos for authentication, and many enterprise single sign-on and identity and access management platforms include an LDAP connector specifically to integrate with these older, on-premises directories. Compared to modern protocols like SAML or OAuth 2.0, LDAP is directory-centric and older, designed for internal network lookups rather than federated web authentication across organizational boundaries. In practice, organizations use LDAP to centralize employee accounts so that applications, VPNs, and network devices can all authenticate against a single directory instead of maintaining separate credential stores. Email systems, file servers, and legacy line-of-business applications frequently include native LDAP support for exactly this reason, and IT teams use LDAP browsers to manage and audit directory contents directly. The protocol's age is also its limitation: LDAP was designed for trusted internal networks, and running it without additional encryption exposes credentials and queries in plaintext, which is why LDAPS, LDAP over TLS, is now considered mandatory in production. It also does not natively support the token-based, cross-domain federation patterns that modern cloud applications expect, which is why organizations increasingly pair LDAP-backed directories with a cloud identity provider that bridges old and new authentication models.
Specification
- Hierarchical directory structure organized as a distinguished-name tree
- Bind operation authenticates users by verifying directory credentials
- Search, compare, add, modify, and delete operations on directory entries
- Underlies Microsoft Active Directory and many on-premises identity systems
- LDAPS variant adds TLS encryption for credentials and queries in transit
- Widely supported by legacy line-of-business and network applications
- Central store for organizational structure, groups, and user accounts