Master the Lightweight Directory Access Protocol with interactive lessons and hands-on practice
The Lightweight Directory Access Protocol (LDAP) is an open, vendor-neutral protocol used to access and maintain distributed directory information services over an IP network. Think of it as a specialized database optimized for reading user accounts, groups, and organizational data.
Organizations need a centralized way to store and retrieve information about users, computers, printers, and policies. LDAP provides a lightweight, standardized way to do this — powering Active Directory, OpenLDAP, and countless authentication systems.
One place to manage all user credentials and access rights
Optimized for millions of read queries; ideal for authentication
Vendor-neutral RFC standard supported by every major OS
Supports TLS encryption and SASL authentication
Tree structure mirrors real-world organizational charts
Used by AD, Linux PAM, web apps, VPNs, and more
| Product | Vendor | Use Case |
|---|---|---|
| Active Directory | Microsoft | Enterprise Windows environments |
| OpenLDAP | Open Source | Linux/Unix directory services |
| 389 Directory Server | Red Hat | Enterprise Linux environments |
| Oracle Internet Directory | Oracle | Oracle middleware stack |
| ApacheDS | Apache | Java-based embedded LDAP |
LDAP follows a client-server model. The client sends operations (bind, search, modify, add, delete) and the server responds. Every session begins with authentication (bind) and ends with an unbind.
| Operation | Code | Description |
|---|---|---|
| Bind | 0 | Authenticate (Simple or SASL) — starts a session |
| Unbind | 2 | Terminate the session gracefully |
| Search | 3 | Query the directory with filters and scope |
| Modify | 6 | Add, delete, or replace attribute values |
| Add | 8 | Add a new entry to the directory |
| Delete | 10 | Remove an entry from the directory |
| ModifyDN | 12 | Rename or move an entry |
| Compare | 14 | Test whether an attribute value exists |
| Abandon | 16 | Cancel a previously sent request |
No credentials — read-only access to public directory info. Common for lookups.
DN + password in plaintext. Must use LDAPS/TLS to protect credentials.
Kerberos, DIGEST-MD5, or GSSAPI. Most secure — used in enterprise AD.
| Scope | Meaning |
|---|---|
| baseObject | Only the base DN entry itself |
| singleLevel | Direct children of the base DN (one level down) |
| wholeSubtree | Base DN and all descendants — most common |
LDAP organizes information in a Directory Information Tree (DIT) — a hierarchical structure similar to a file system. Each node is an entry identified by a Distinguished Name (DN).
A DN is the unique identifier for an entry, reading from specific (left) to general (right):
| Abbreviation | Full Name | Example |
|---|---|---|
| cn | Common Name | cn=John Smith |
| sn | Surname | sn=Smith |
| ou | Organizational Unit | ou=Engineering |
| o | Organization | o=Acme Corp |
| dc | Domain Component | dc=example |
| uid | User ID | uid=jsmith |
| c | Country | c=US |
| Attribute | OID Short | Description |
|---|---|---|
| objectClass | 2.5.4.* | Defines schema rules for the entry (e.g., inetOrgPerson) |
| uid | 0.9.2342… | User login name |
| cn | 2.5.4.3 | Common name (display name) |
| sn | 2.5.4.4 | Surname / family name |
| 0.9.2342… | Email address | |
| userPassword | 2.5.4.35 | Hashed password (SSHA, bcrypt, etc.) |
| telephoneNumber | 2.5.4.20 | Phone number |
| memberOf | — | Groups this entry belongs to |
| givenName | 2.5.4.42 | First name |
| title | 2.5.4.12 | Job title |
Every LDAP entry must have an objectClass that defines which attributes are required and permitted:
Standard user account — includes uid, mail, cn, sn
Group entry containing a list of member DNs
Represents computers, printers, and network devices
Top-level org entry with the 'o' attribute required
LDAP messages are encoded using ASN.1 BER (Basic Encoding Rules). Every message — request or response — wraps in a common envelope called the LDAPMessage.
| Field | Description |
|---|---|
| messageID | Unique integer to match requests with asynchronous responses (1–2,147,483,647) |
| protocolOp | The actual LDAP operation (e.g., SearchRequest, BindRequest, SearchResultEntry) |
| controls | Optional extensions — paging, sort, LDAP transactions, etc. |
| baseObject | The DN where the search starts (e.g., dc=example,dc=com) |
| scope | 0=baseObject, 1=singleLevel, 2=wholeSubtree |
| derefAliases | How to handle alias entries (never, inSearching, findingBaseObj, always) |
| sizeLimit | Max number of entries to return (0=no limit) |
| timeLimit | Max seconds to execute (0=no limit) |
| filter | Boolean expression selecting which entries to return |
| attributes | List of attribute types to return (empty = return all) |
| Code | Name | Meaning |
|---|---|---|
| 0 | success | Operation completed successfully |
| 1 | operationsError | Server encountered an internal processing error |
| 2 | protocolError | Malformed request sent by client |
| 3 | timeLimitExceeded | Operation exceeded the time limit |
| 4 | sizeLimitExceeded | More results exist than the size limit allows |
| 10 | referral | Server cannot handle request; refers to another server |
| 32 | noSuchObject | The target DN does not exist |
| 34 | invalidDNSyntax | The provided DN is malformed |
| 49 | invalidCredentials | Wrong password / bad credentials (auth failure) |
| 50 | insufficientAccessRights | Caller lacks permission for the operation |
| 53 | unwillingToPerform | Server refuses (e.g., password policy) |
Search filters use prefix (Polish) notation wrapped in parentheses:
| Filter | Example | Meaning |
|---|---|---|
| Equality | (cn=Alice) | cn equals "Alice" |
| Substring | (mail=*@example.com) | mail ends with @example.com |
| Present | (telephoneNumber=*) | telephoneNumber attribute exists |
| AND | (&(uid=jsmith)(objectClass=person)) | Both conditions true |
| OR | (|(cn=Alice)(cn=Bob)) | Either condition true |
| NOT | (!(accountLocked=TRUE)) | Condition is false |
| Approx | (cn~=Alyss) | Approximately equal (soundex) |
| Greater/Less | (uidNumber>=1000) | Numeric/lexicographic comparison |
Build and simulate LDAP search queries interactively. Construct a filter and see the generated query string plus a simulated response.
LDIF (LDAP Data Interchange Format) is the standard text format for importing/exporting LDAP entries.
Test your understanding of LDAP concepts!
10 questions covering LDAP fundamentals, message format, directory structure, and security.