This article was accepted into the corpus but its outbound wikilinks were never NER-processed — typical at the deepest BFS hop or when the run's entity cap was reached. No expansion funnel to show.
| LDAP (protocol) | |
|---|---|
| Name | LDAP |
| Developer | University of Michigan; Internet Engineering Task Force |
| Released | 1993 |
| Latest release | Various RFCs and vendor releases |
| Operating system | Unix, Windows NT, Linux, macOS |
| Genre | Directory service protocol |
| License | RFCs and vendor licenses |
LDAP (protocol) is an application protocol for accessing and maintaining distributed directory information services across an Internet Protocol network. It is used to query and modify directory entries held by directory services provided by vendors and open source projects. The protocol underpins identity management in many Microsoft domains, Apple infrastructures, and large deployments in Google and Amazon Web Services environments.
LDAP was designed to provide a lightweight alternative to the X.500 Directory Access Protocol used in International Telecommunication Union systems and to enable client applications to read and write directory information. LDAP supports a hierarchical namespace and a schema-driven data model that is well suited to representing organizational structures such as entries for users, groups, devices, and services. Implementations interoperate using standard operations including Bind, Search, Compare, Abandon, Add, Delete, Modify, Modify DN, and Extended operations standardized by the Internet Engineering Task Force.
LDAP traces origins to research at the University of Michigan in the early 1990s as a simpler alternative to X.500 Directory Access Protocol for the then-emerging World Wide Web and enterprise networks. Early versions evolved through the involvement of organizations such as Netscape Communications Corporation, Oracle Corporation, and Microsoft Corporation, and were formalized in a series of IETF RFCs. Major milestones include the LDAPv3 specification which became an Internet Standard and influenced directory products from Sun Microsystems, Novell, IBM, and several open source projects like OpenLDAP.
The protocol operates over Transmission Control Protocol or User Datagram Protocol encapsulated within Internet Protocol networks, typically using ports 389 for plain connections and 636 for LDAP over TLS. LDAP defines a client–server model where clients issue protocol operations encoded using ASN.1 and transmitted via the Basic Encoding Rules. Core operations include Bind for authentication, Search for retrieving entries with filters, and Modify for updating attributes. Extended operations and controls allow vendors and standards bodies such as IETF to add features like StartTLS, persistent searches, and proxied authorization used by large providers such as Facebook and Twitter infrastructures.
LDAP directories represent data as entries composed of attributes identified by attribute types and object classes governed by a schema. The schema model derives from X.500 and supports extensibility through custom object classes and attribute definitions used by vendors like Microsoft in Active Directory and by projects like OpenLDAP. Distinguished Names uniquely identify entries within a hierarchical namespace that can reflect geographic or organizational partitions such as those used by United Nations agencies or multinational corporations like IBM. Common attribute syntaxes include Directory String, Integer, and Binary, enabling representation of passwords, certificates issued by Certificate Authoritys, and public keys used by Secure Shell.
LDAP supports multiple authentication mechanisms including simple authentication, SASL-based mechanisms like DIGEST-MD5 and GSSAPI, and integrated Windows authentication via Kerberos in Active Directory. Transport Layer Security using StartTLS or LDAPS provides confidentiality and integrity, and access control mechanisms enforce authorization policies. Security considerations often involve integration with identity providers such as Okta, Ping Identity, and Shibboleth, as well as compliance frameworks implemented by organizations like National Institute of Standards and Technology and cross-domain federations in European Union institutions.
There are many LDAP server and client implementations from both proprietary and open source communities. Notable servers include OpenLDAP, Active Directory from Microsoft, 389 Directory Server from the Red Hat ecosystem, and Apache Directory Server. Interoperability matrices and connectors exist for systems like Samba for file and print services, OpenSSL tooling for TLS integration, and enterprise identity systems from Oracle and IBM. Client libraries and utilities are available across platforms, enabling integration with applications developed by companies such as Cisco Systems and VMware.
LDAP servers are designed for high read throughput and can be scaled using replication, partitioning, and caching strategies employed by deployments at companies like Yahoo!, LinkedIn, and Amazon. Replication models include master–slave and multi-master topologies; caching layers such as reverse proxies and application-level caches reduce load. Performance tuning involves indexing attributes, optimizing schema design, and leveraging hardware acceleration and distributed storage as practiced by Facebook and cloud providers like Google Cloud Platform.
The core LDAP specifications are maintained in a series of IETF RFCs that define protocol elements, schema, and authentication frameworks. Numerous extensions and profiles address enterprise needs: StartTLS for opportunistic security, Persistent Search for event notification, and vendor-specific controls for features in Active Directory. Standards bodies and industry consortia such as OASIS and ISO influence directory-related specifications that intersect with LDAP, while working groups in the IETF continue to evolve the protocol to address modern identity use cases.
Category:Internet protocols