LDAP: Querying directory services

In short: A protocol for querying and managing entries such as users, groups and devices in a central directory.

In more detail: LDAP (Lightweight Directory Access Protocol) is a standardised way to access directory services. A directory is a hierarchically structured database optimised for reading, in which, for example, employees are stored with name, email and group membership. Microsoft Active Directory and OpenLDAP are the best-known examples.

In Depth

Structure: tree, entries, DN

The data forms a tree (DIT, directory information tree). Every entry has a unique distinguished name (DN) describing the path from the root, for example:

cn=Anna Beispiel,ou=Vertrieb,dc=firma,dc=de

dc stands for domain component, ou for organisational unit, cn for common name. Entries have attributes such as mail, uid or memberOf, whose permitted types a schema defines.

Typical operations

• Bind: signing in to the server (anonymously, with user and password or by certificate).
• Search: finding entries, with a base DN, scope and filter, e.g. (&(objectClass=person)(uid=anna)).
• Add / Modify / Delete: creating, changing or deleting entries. Applications often use LDAP for sign-in: they search for the user, then try a bind with that user’s password and evaluate the result.

Security

The default port 389 transmits in plain text. Use LDAPS (port 636, TLS from the start) or StartTLS on port 389. Filters built from user input must be escaped, otherwise LDAP injection threatens, similar to SQL injection. Service accounts for searches should have read-only rights (principle of least privilege).

Distinction

LDAP is not a database for application data with many writes, but for rarely changed, frequently read master data. Modern web sign-in more often runs through SAML or OpenID Connect, which in the background still frequently use an LDAP directory as the source of accounts.

See also: Authentication, Single sign-on, TLS, Principle of least privilege