LDAP

Directory Services and the X.500 Heritage

Lightweight Directory Access Protocol is a protocol for accessing and maintaining distributed directory information services over TCP (port 389, or 636 for LDAPS). A directory is a specialized database optimized for reads — storing users, groups, computers, and policies in a hierarchical tree (Distinguished Names, Organizational Units). Microsoft Active Directory is the dominant LDAPLightweight Directory Access Protocol. A protocol for accessing and maintaining distributed directory information services (such as Active Directory) over TCP/IP. Used for centralized authentication and user directory lookups. implementation in enterprise environments.

Authentication and Authorization Flow

LDAP is the backbone of enterprise authentication. When a user logs into a corporate application, the application binds to the LDAP server with service credentials, searches for the user's Distinguished Name, and then attempts a bind with the user's DN and supplied password. Group membership attributes (memberOf) drive authorization — a VPNVirtual Private Network. A technology that creates an encrypted tunnel between a device and a remote server, protecting data in transit and masking the user's real IP address. Used for privacy, security, and accessing restricted networks. server queries LDAP to determine which users belong to the "VPN-Users" group before granting access.

Security Hardening

Plain LDAP (port 389) transmits credentials in cleartext. All production deployments must use LDAPS (LDAP over SSL/TLSSecure Sockets Layer / Transport Layer Security. Cryptographic protocols that provide encrypted, authenticated communication over a network. SSL is deprecated; modern implementations use TLS 1.2 or TLS 1.3., port 636) or LDAP StartTLS. Bind credentials (service accounts) should be read-only and have minimal scope. LDAP injection — analogous to SQL InjectionA code injection attack that inserts malicious SQL statements into application input fields to manipulate or extract data from a backend database. Prevented by parameterized queries and input validation. — occurs when user input is concatenated into LDAP filter strings without escaping. RADIUSRemote Authentication Dial-In User Service. A networking protocol that provides centralized authentication, authorization, and accounting (AAA) for users connecting to a network. Commonly used for Wi-Fi, VPN, and ISP authentication. often integrates with LDAP, forwarding authentication requests to the directory so network devices don't need direct LDAP access. A misconfigured LDAP server allowing anonymous binds is a high-priority penetration testing finding. Open Port Checker can verify whether port 389 or 636 is unintentionally internet-accessible.