LDAP
Also known as: Active Directory, OpenLDAP, LDAPS, directory services, AD
LDAP (Lightweight Directory Access Protocol) is a protocol for accessing directory services: structured databases of users, groups, computers, and other network resources.
It's the protocol underlying Microsoft Active Directory and many enterprise authentication systems, used to look up whether a user exists and verify their password.
LDAP, explained at three levels
At home
LDAP is the system that lets a company manage all its employees in one place. When you log in to your work computer, it checks LDAP to verify your username and password. When IT adds you to the 'Finance' group, every system connected to LDAP knows you belong to Finance.
At work
LDAP is behind the scenes of corporate login systems. When an employee's account is created or disabled in Active Directory, every connected application (email, VPN, file shares) sees the change on its next lookup, because they all query the same directory over LDAP.
At home
LDAP directories organize data hierarchically using distinguished names (DN): 'cn=John Smith,ou=Finance,dc=company,dc=com'. Entries have attributes (cn for common name, mail for email, memberOf for groups). Searches use LDAP filter syntax: '(&(objectClass=person)(mail=john@company.com))'. LDAP uses port 389 (plain) or 636 (LDAPS, with SSL).
At work
Applications integrate with LDAP for two purposes: authentication (binding with a user's credentials to verify they're valid) and authorization (querying group memberships to determine permissions). LDAP integration is common in VPNs, enterprise applications, Wi-Fi authentication (802.1X), and email servers. Active Directory is Microsoft's LDAP implementation with additional features (Kerberos, DNS, Group Policy).
At home
LDAP's bind operation authenticates a user by attempting to connect as that user's DN with their credentials. Simple bind (password in plaintext) requires LDAPS or STARTTLS. SASL bind supports Kerberos, GSSAPI, and other mechanisms for stronger authentication. Referrals allow distributed directory trees where one server refers queries to another.
At work
Active Directory extends LDAP with a proprietary schema and requires special handling: LDAP over SSL port 636 or STARTTLS on 389; specific filter syntax for nested group membership (LDAP_MATCHING_RULE_IN_CHAIN); and use of userPrincipalName rather than cn for authentication. Enterprises migrating from LDAP-only to modern identity use SCIM (System for Cross-domain Identity Management) to provision users to SaaS apps, complementing LDAP-based authentication.
Real-world examples
At home
Aisha's office uses Active Directory. When she changes her password, the new password works right away for email, VPN, Wi-Fi, and other corporate systems, because they all check it against the same directory. One change covers everything.
At work
Marcus's company runs OpenLDAP for their Linux infrastructure alongside Microsoft Active Directory for Windows. Its Linux servers authenticate users against the AD domain over LDAP and Kerberos (using tools such as SSSD), giving one unified directory for the whole organization.
Common confusions
- LDAP is outdated and replaced by SAML/OIDC — LDAP handles authentication for internal network resources (Wi-Fi, VPN, Linux servers, traditional enterprise apps). SAML and OIDC handle web application SSO. They're complementary: most enterprises use LDAP as the source of truth and SAML/OIDC as the federation layer for web apps.
- Active Directory and LDAP are the same thing — Active Directory is Microsoft's directory service that uses LDAP as one of its protocols. AD adds Kerberos authentication, Group Policy, DNS integration, and more. LDAP is a protocol; AD is a product that implements (and extends) that protocol.
For analysts
LDAP group membership is often the source of truth for application access control. When a BA needs access to a new data source, the answer is usually 'ask IT to add you to the relevant LDAP group': understanding this speeds up access requests.
History & origin
LDAP was developed at the University of Michigan in the early 1990s as a lightweight alternative to the X.500 directory standard. It became the standard protocol for accessing directory services. Microsoft built Active Directory, released with Windows 2000, on LDAP, making it ubiquitous in enterprise environments. LDAP remains the backbone of enterprise identity infrastructure, though it's increasingly complemented by OIDC and SAML for web applications. OpenLDAP is the dominant open-source LDAP server.