Lightweight Directory Access Protocol (LDAP)

LDAP is a standardized protocol for accessing and managing directory information services over IP networks. It provides a structured, hierarchical way to organize and retrieve data efficiently, making it essential for enterprise authentication, user management, and directory services.

Key Points

• Organizes data in a directory tree for fast lookups and scalable management
• Core components include directories, entries, attributes, and Distinguished Names (DNs)
• Uses filters for precise querying of directory data
• Secures connections via LDAPS (LDAP over SSL/TLS)
• Powers enterprise solutions like Active Directory and OpenLDAP

---

How LDAP Works

LDAP structures data in a directory tree, where each entry has a unique identifier and can be queried using filters. This design enables efficient data retrieval and scalable directory management.

Core Components

Component	Description
Directory	A read-optimized database storing hierarchical data
Entry	A single record (e.g., user, group, or device)
Attribute	A property of an entry (e.g., cn for common name, mail for email)
Distinguished Name (DN)	A unique path-based identifier for an entry (e.g., cn=John,ou=users,dc=example,dc=com)

---

Directory Structure

LDAP directories follow a tree-like hierarchy with parent-child relationships, ensuring efficient organization and retrieval.

Hierarchical Levels

1. Root (Top-Level Domain - TLD)
   • Base of the directory (e.g., dc=example,dc=com)
2. Organizational Units (OUs)
   • Subdivisions for grouping (e.g., ou=people, ou=groups)
3. Entries
   • Individual records (e.g., cn=John Doe)

Example DN: cn=John Doe,ou=people,dc=example,dc=com This DN uniquely identifies "John Doe" in the "people" OU under the "example.com" domain.

---

Identifiers and Attributes

Distinguished Names (DNs)

• Full path to an entry (e.g., uid=jsmith,ou=users,dc=company,dc=org)
• Acts as the primary key for directory entries

Relative Distinguished Names (RDNs)

• Leftmost part of a DN (e.g., uid=jsmith)
• Must be unique within its parent entry

Common Attributes

Attribute	Description	Example Value
cn	Common name	John Smith
uid	User ID	jsmith
mail	Email address	john@example.com
objectClass	Defines entry type	person, group

---

Search and Query

LDAP uses filters to search directories efficiently. Filters support exact matches, wildcards, and logical operators.

Basic Filter Syntax

Operator	Description	Example
=	Exact match	(cn=John Doe)
~=	Approximate match	(cn~=Jon Doe)
>=	Greater than or equal	(uidNumber>=1000)
&	Logical AND	(&(cn=John)(mail=*@example.com))
`	`	Logical OR
!	Logical NOT	(!(ou=temp))

Example Query: Find all users in "people" OU with names starting with "J":

(&(ou=people)(cn=J*))

---

Real-World Implementations

Enterprise Solutions

1. Microsoft Active Directory (AD)

   • Uses LDAP for authentication, group management, and policy enforcement
   • Example: Storing user credentials and permissions in an LDAP-compatible directory

2. OpenLDAP

   • Open-source LDAP implementation for Linux/Unix environments
   • Example: Integrating with applications like Nextcloud for centralized authentication

Cloud Services

• Google Workspace and AWS Directory Service use LDAP for identity management

---

Best Practices

• Design a logical hierarchy to minimize search depth
• Index frequently queried attributes (e.g., uid, mail) for performance
• Use LDAPS to encrypt data in transit
• Restrict access to sensitive attributes (e.g., userPassword) via Access Control Lists (ACLs)
• Monitor directory performance and optimize queries

---

Key Takeaways

• LDAP is a protocol for accessing and managing directory services over networks
• Data is organized in a hierarchical tree with DNs as unique identifiers
• Filters enable efficient searching and retrieval
• Widely used in Active Directory, OpenLDAP, and cloud identity services
• Security (LDAPS, ACLs) is critical for implementations

---

Learn More

• LDAP Technical Specification: RFC 4510
• Active Directory LDAP Docs: Microsoft LDAP Documentation
• OpenLDAP Admin Guide: Official OpenLDAP Docs
• LDAP Query Examples: LDAP.com Filter Guide
• Security Best Practices: OWASP LDAP Injection Prevention