LDAP
In plain English
Plain definition
LDAP (Lightweight Directory Access Protocol) is a way for applications to look up and manage information held in a directory: a specialised store organised as a tree of entries, broadly similar in purpose to a phone book, but used for organisational data such as user accounts, groups and devices.
Technical Definition
LDAP is a client–server protocol for accessing and maintaining distributed directory information over a network. It defines a data model in which entries are composed of attributes and identified by a distinguished name within a hierarchical namespace, a set of operations a client issues against a directory server (including bind, search, compare, add, modify, delete, modify DN, unbind and extended operations), and a wire encoding used to exchange those operations. LDAP was designed as a lighter-weight alternative to the earlier X.500 Directory Access Protocol, retaining the directory-information-tree concept while reducing overhead for use over TCP/IP networks.
Operational Relevance
In production estates, LDAP is frequently the protocol behind centralised authentication and directory lookups: application servers, VPN concentrators and mail systems query an LDAP directory to verify credentials, resolve group membership or retrieve user attributes. Because directory availability sits on the critical path for logins across many downstream services, LDAP servers and their supporting dependencies — name resolution, TLS termination and replication — are commonly treated as tier-one infrastructure requiring monitoring, redundancy and formal change control.
Architecture Relationship
LDAP is the access protocol for directory service implementations such as OpenLDAP, and it is one of the protocols exposed by Microsoft Active Directory’s directory database. It is often paired with Kerberos in enterprise environments: LDAP handles attribute and group lookups, while Kerberos handles ticket-based authentication. Directories are frequently replicated across sites, and clients are typically configured against a logical service endpoint — a load balancer or DNS service record — rather than a single server, to avoid a single point of failure.
Example
A helpdesk application authenticating a user typically performs an LDAP bind using the credentials the user supplied, against the directory’s bind distinguished name. On success, it issues a filtered LDAP search for that user’s identifier to retrieve group membership attributes, which the application then uses for authorisation decisions.
Misunderstanding
A common misunderstanding is treating “LDAP” and “Active Directory” as interchangeable terms. LDAP is a protocol; Active Directory is a directory service that exposes LDAP, among other interfaces, as one access method. A directory service can support LDAP without being Active Directory, and Active Directory offers protocol interfaces beyond LDAP.
Related Terms
- Active Directory
- OpenLDAP
- Kerberos
- Distinguished Name (DN)
- Directory Information Tree (DIT)
- X.500
Further Reading
The RFC Editor maintains the RFC Series, the authoritative publication channel for the specifications governing protocols such as LDAP. Before citing specific LDAP RFC numbers or version-dependent behaviour in operational documentation, confirm the current specification set and your directory vendor’s supported version, since exact RFC numbering is not asserted in this entry pending verification.