LDAP

networkingsecurity

Stands for: Lightweight Directory Access Protocol

The protocol for querying and modifying directory services like Active Directory.

Lightweight Directory Access Protocol (RFC 4511) reads and writes hierarchical directory data - users, groups, attributes. It is central to enterprise authentication and identity.

LDAP is how applications ask a directory who someone is and what groups they belong to, and it long predates the identity protocols that layer on top of it. Active Directory speaks it, most enterprise directories speak it, and a surprising amount of authentication still bottoms out in an LDAP query.

The model catches people out because it is hierarchical rather than relational. Entries live in a tree, identified by a distinguished name that reads from the specific to the general, and queries are filters in prefix notation with their own parenthesised grammar. Writing one correctly the first time is uncommon, and a filter that is merely wrong rather than malformed will return the wrong users silently.

Two operational details cause most incidents. A bind is authentication, and an anonymous or unprivileged bind may succeed while returning far less than expected, which looks like missing data rather than missing permission. And plain LDAP is unencrypted, so credentials cross the network in the clear unless LDAPS or StartTLS is in use, which is why directory traffic is a standing finding in security reviews.

Also known as: ldap

← All glossary entries