What Is LDAP?

Lightweight Directory Access Protocol (LDAP) is an open and cross-platform language that is used between a client and a server over a persistent connection. It defines how clients should encode requests and how servers should encode responses.

The use case for the creation of LDAP was to provide a secure authentication tool for enterprises, but it has other functions, too. It can be used in a network’s active directory, where it encodes, stores, accesses, and manages user and device information (and other data). Types of data stored are usernames and passwords, account details, printer connections, email addresses, and other sensitive data.

Specific functions include:

• Storing a systematic set of records and data in a hierarchical structure

• Searching and retrieving data within that structure that matches a given set of criteria

• Authenticating and authorizing users and devices

• Organizing groups

• Creating policy

How LDAP Works with Authentication

To start an LDAP authentication session, a client needs to connect to the server. After connection is established, the client and the server can exchange packets of data. When a user request comes into the server, their credentials are authenticated against data that was previously entered by the administrators. If the data matches, they gain access. If it doesn’t, they’re denied access.

How LDAP Works with Non-authentication Requests

The LDAP directory on the server is set up in a treelike, or hierarchical, structure. When a user requests information, the database doesn’t need to know the location of the data. It uses LDAP to search for the data, organizations, individuals, or resources (such as files or devices) with a top-down approach. It works its way down the tree until the requested information is found. For further granularity, each group in the tree can also have its own hierarchy.

Why Do We Need LDAP?

LDAP simplifies the process of identifying one employee amongst thousands. Each employee has their own data stored in LDAP language, along with their permissions. There are apps, services, and systems they are allowed to have access to, and there are other areas that they don’t have access to. LDAP keeps track of this so your administrators don’t have to. The security policy can live in the domain controller so you can define who has access to what (such as a file, a device, or permission to change their desktop background or download a file).

If he wanted to get more specific, Gordon could also create a hierarchy within the accounting department group. He could create two subgroups that narrow permissions down even more: Group A and Group B. Since Gordon runs the accounting group, he can also hand out permissions to subgroups that he creates. He can assign permissions to one, a few, or many people to have access to a particular set of files, devices, etc. 

This ability to create groups and subgroups in an LDAP hierarchical structure streamlines the permissions process because the accounting department employee only has to go to Gordon for permission to access files and devices and not all the way back to the main network administrator.

Conclusion

LDAP is a way to talk to an active directory. It provides a standardized way to store, identify, and define data in an organized hierarchical way. When the user queries the LDAP database for a specific object, it walks down the directory tree to find that object for the requestor. All permissions are contained within the various domains, so access can be quickly allowed or denied. There are many other ways LDAP can be used to streamline data storage, access, and retrieval, which makes it a very popular option for enterprises today.