Identity · Directories
LDAP
Lightweight Directory Access Protocol is the query and update protocol for directory services, running on TCP/389 or TCP/636 for LDAPS.
IntermediateUpdated 2026-09-01
Overview
LDAP defines a hierarchical namespace of distinguished names and a search syntax used by applications to look up users, groups and attributes. Many applications still authenticate by performing an LDAP simple bind with the user's credentials.
Simple bind over plaintext LDAP sends credentials in the clear. Use LDAPS or StartTLS, and prefer modern token based authentication where the application supports it.
Security considerations
- Require LDAP signing and channel binding on domain controllers to prevent relay attacks.
- Give application service accounts read only, scoped access rather than broad directory rights.