LDAP (directory service)

LDAP (directory service)
Name	LDAP
Caption	Lightweight Directory Access Protocol
Invented	1993
Developer	Tim Howes; University of Michigan; Internet Engineering Task Force
Type	Directory service protocol

LDAP (directory service) Lightweight Directory Access Protocol (LDAP) is an open, vendor-neutral application protocol for accessing and maintaining distributed directory information services. It is widely used across computing environments for authentication, authorization, and directory lookup, interoperating with systems and standards from vendors and institutions across enterprise, academic, and government settings. LDAP underpins deployments ranging from identity management systems to networked applications and integrates with many operating systems, cloud providers, and security frameworks.

Overview

LDAP serves as a client–server protocol that enables applications to query and modify directory entries stored in hierarchical data stores. Implementations commonly interact with operating systems such as Microsoft Windows Server, Red Hat Enterprise Linux, Ubuntu (operating system), and services from Amazon Web Services, Google Cloud Platform, and Microsoft Azure. Directory services that use LDAP often integrate with identity and access products from Okta, Oracle Corporation, IBM, NetIQ, and Ping Identity, and interoperate with standards bodies and protocols like the Internet Engineering Task Force, Simple Authentication and Security Layer, and Transport Layer Security.

History and Development

LDAP was developed in 1993 by Tim Howes and colleagues at the University of Michigan as an open alternative to the X.500 directory standard maintained by the International Telecommunication Union. Early specification work and extensions were coordinated through the Internet Engineering Task Force and published as a series of RFCs that drew contributions from vendors such as Sun Microsystems, Novell, and Microsoft Corporation. Over time LDAP evolved with related efforts from organizations including the OpenLDAP Project, The Apache Software Foundation, and commercial vendors responding to enterprise demands influenced by standards-driven initiatives like the IETF LDAPEXT Working Group.

Protocol and Architecture

LDAP defines a stateless request/response protocol layered over reliable transport such as Transmission Control Protocol and secured transports like Transport Layer Security. The protocol specifies operations including Bind, Search, Compare, Add, Delete, Modify, and Unbind and supports controls and extensions standardized via the IETF process. LDAP directories typically expose a tree-structured namespace similar to a distinguished name hierarchy derived from concepts in X.500 and are often used with replication mechanisms inspired by distributed systems research exemplified by work from Lamport and practical replication implementations from vendors like Red Hat and Oracle. Interoperability is fostered by adherence to RFCs and testing by consortia including OASIS and various identity federations such as InCommon.

Data Model and Schema

LDAP organizes data as entries composed of attributes and objectClasses, with each entry identified by a distinguished name (DN). Schemas define attribute types and objectClasses and are maintained by implementers and organizations like IETF and projects such as OpenLDAP and 389 Directory Server. Common objectClasses map to standards and platforms including posixAccount for Unix-like systems and inetOrgPerson for directory-enabled applications, enabling integration with mail systems like Postfix, Microsoft Exchange, and collaboration platforms such as Atlassian Confluence. Schema extensibility allows integration with identity metadata from SAML, OAuth 2.0, and provisioning specifications developed by SCIM and other standards groups.

Security and Authentication

LDAP supports multiple authentication mechanisms ranging from anonymous binds to password-based SIMPLE binds and stronger mechanisms using SASL mechanisms such as DIGEST-MD5 or GSSAPI (Kerberos). Deployments commonly secure LDAP traffic with TLS and integrate with enterprise authentication infrastructures including MIT Kerberos, Active Directory Federation Services, and cloud identity platforms like Azure Active Directory. Access control is implemented via access control lists and ACL models provided by directory servers from vendors including OpenLDAP Project, Red Hat, Oracle Corporation, and IBM, and is influenced by cryptographic standards published by organizations like the National Institute of Standards and Technology.

Implementations and Deployments

Representative open-source and commercial implementations include OpenLDAP Project, Microsoft Active Directory, Red Hat 389 Directory Server, Oracle Directory Server Enterprise Edition, and Apache Directory Server. LDAP servers are deployed in academic institutions such as the University of Michigan and enterprises including Google, Facebook, and Amazon for use cases spanning single sign-on, address books, application configuration, and network device authentication. Integration ecosystems involve identity providers like Okta and Ping Identity, directory synchronization tools such as Microsoft Identity Manager, and management frameworks used by corporations like Cisco Systems.

Administration and Management

Administrative tasks encompass schema design, replication configuration, backup and recovery, monitoring, and tuning. Administrators use tools including command-line utilities from OpenLDAP Project and graphical consoles provided by Red Hat and Microsoft; automation and orchestration often leverage configuration management platforms like Ansible (software), Puppet (software), and Chef (software). Operational best practices derive from case studies and guidance published by vendors and standards groups including IETF and NIST, and are maintained in enterprise documentation from organizations such as CIS and vendor knowledge bases.

Category:Directory services