What is LDAP?

 

What Is Lightweight Directory Access Protocol (LDAP)?

LDAP is a lightweight version of the Directory Access Protocol (DAP). Its original goal was to provide low-overhead access to an X.500 Directory, but the tool now has a wider variety of uses, which we will discuss later.

LDAP’s primary function is enabling users to find data about organizations, persons, and more. It accomplishes this goal by storing data in the LDAP directory and authenticating users to access the directory. It also provides the communication language that applications require to send and receive information from directory services.

Data and resources that you can find with LDAP include files and user information. It works with printers, computers, and other devices connected via the internet or a company’s intranet.

LDAP works with most vendor directory services, such as Active Directory (AD). With LDAP, sharing information about users, services, systems, networks, and applications from a directory service to other applications and services becomes easier to implement.

What Is LDAP Authentication?

A user cannot access information stored within an LDAP database or directory without first authenticating (proving they are who they say they are). The database typically contains user, group, and permission information and delivers requested information to connected applications.

LDAP authentication involves verifying provided usernames and passwords by connecting with a directory service that uses the LDAP protocol. Some directory-servers that use LDAP in this manner are OpenLDAP, MS Active Directory, and OpenDJ.

Here’s a step-by-step breakdown of the authentication process:

• The client (an LDAP-ready system or application) sends a request to access information stored within an LDAP database.
• The client provides their LDAP server user credentials (username and password).
• The LDAP server cross-checks the user’s submitted credentials against the core user identity data stored in its LDAP database.
• If the provided credentials match the stored core user identity, the client can access the requested information.
• Incorrect credentials will lead to denied access to the LDAP database.

Note that the core user identity stored in the LDAP database isn’t necessarily just usernames and passwords, but also other attributes like addresses, telephone numbers, and group associations.

LDAP vs Active Directory

Active Directory (AD) was developed by Microsoft for Windows domain networks. It is included as a set of services and processes in most Windows operating systems and contains information about each user account connected to the network.

LDAP is a tool for extracting and editing data stored in Active Directory and other compatible directory service providers. Each user account in an AD has several attributes, such as the user’s full name and email address. Extracting this information in a usable format requires LDAP.

LDAP extracts information from AD with a simple, string-based query. LDAP can also share the extracted information (such as usernames and passwords) with connected devices or applications.

Using LDAP eliminates the need for users to manually enter a string of LDAP queries to retrieve information from AD. For example, Microsoft Outlook is an LDAP-enabled Windows program that enters queries automatically to get you the information you want.

What is LDAP used for?

Since LDAP is an open and cross-platform protocol, it works with several directory service providers and has various applications. The most common LDAP use case is serving as a central location for storing authentication information, such as usernames and passwords. You can use the stored authentication information on various applications to validate users.

Popular applications that support LDAP authentication are OpenVPN, Docker, Jenkins, Kubernetes, and Linux Samba servers. System administrators also use LDAP’s single sign on (SSO) feature to manage LDAP database access.