LDAP Overview

The Organizational Source of Truth

LDAP (Lightweight Directory Access Protocol) is the foundational architecture for managing organizational identity at scale. Built to be a “Heavy-Read, Light-Write” directory service, it provides a hierarchical structure for storing and retrieving user profiles, group memberships, and device information. While modern web apps often use OAuth2/OIDC, LDAP remains the “Core of the Enterprise,” serving as the primary source of truth for Active Directory, OpenLDAP, and FreeIPA. It enables a single point of administration for internal network resources, ranging from VPNs and Wi-Fi to legacy corporate applications and server-level access control.

Core Mission

Centralized Schema Enforced Identity. Providing a globally consistent, tree-based data model that represents the complex relationships within an organization.

Like a Digital Organizational Chart: Imagine a massive, interactive corporate phonebook. It doesn't just list names; it shows that Jane Doe is in the "Security" department, which is part of the "IT" division, located in the "New York" office. LDAP allows any application in the company to instantly look up Jane's phonebook entry, verify her password, and see exactly which departments (Groups) she belongs to, making it the bedrock of internal RBAC.

Corporate Identity / Active Directory / Network Policy / VPN Access

The Directory Ecosystem

LDAP organizes data in a unique, hierarchical structure called a Directory Information Tree (DIT).

Strategic Structural Components

Component	Strategic Responsibility
Object Class	The Template. Defines the required and optional attributes for an entry (e.g., `person`, `posixAccount`).
Attribute	The Data Field. Stores specific values like `mail`, `uid`, or `memberOf`.
Distinguished Name (DN)	The Unique Path. The absolute “Coordinate” of an entry (e.g., `uid=jdoe,ou=users,dc=example,dc=com`).
LDAP Schema	The Ruleset. The master definition of which object classes and attributes are valid in the directory.

The Directory Handshake

Authenticating a user against LDAP involves a two-step “Search and Bind” pattern.

sequenceDiagram
    participant App as Application
    participant LDAP as Directory Server
    
    App->>LDAP: Connect (STARTTLS)
    App->>LDAP: Search (find DN for user "jdoe")
    LDAP-->>App: Return DN: uid=jdoe,ou=users,dc=ex...
    App->>LDAP: Bind (DN + Password)
    LDAP-->>App: Success / Failure
    App->>LDAP: Retrieve Group Memberships
    App->>LDAP: Unbind / Close

Connect & Secure

The application establishes a TCP connection. For security, it immediately initiates **STARTTLS** (or uses LDAPS on port 636) to encrypt the communication channel before any credentials are transmitted.

Search & Identify

Because users rarely know their full "Distinguished Name," the application first performs an anonymous or service-account search to find the user's entry based on their email or employee ID.

Bind & Verify

The application attempts a "Bind" operation using the discovered DN and the password provided by the user. The directory server verifies the password against its internal hash and grants a successful bind result.

Strategic Infrastructure Matrix

LDAP occupies a specific niche in the identity stack, optimized for hierarchy and internal network consistency.

Protocol Comparison

Feature	LDAP	Database (SQL)	OIDC (Web)
Data Model	Hierarchical Tree.	Relational Tables.	Flat Claims/JSON.
Read/Write	99% Read Optimized.	Transaction Heavy.	Request/Response.
Primary Use	Infrastructure / Network.	Application State.	App SSO / Web Auth.
Auth Style	Direct Password Check.	Custom Logic.	Indirect Token Exchange.

LDAP Implementation Guides

Master the technical nuances of directory management and organizational identity.

Next Steps

Explore Provisioning Patterns for syncing LDAP data with modern cloud apps.
Review Active Directory (AD) for Microsoft-specific directory extensions.
Check LDAP Schema Extension for adding custom attributes to your directory.