Skip to main content

LDAP: The Lightweight Directory Access Protocol Explained

Published on:
.
10 min read

Thousands of users are usually managed at once by enterprise network administrators. This implies that they are in charge of allocating policies and access controls according to a user's role and permission to access files for routine operations, such as using an intranet for the business.

Network administrators can save a great deal of time and effort by centralizing the authentication process and streamlining the user management process with Lightweight Directory Access Protocol (LDAP). Applications can query user information quickly thanks to the LDAP protocol. There are two things that someone in your office wishes to do: Transmit an email to a newly hired employee and utilize a new printer to print a copy of the exchange. The lightweight directory access protocol, or LDAP, enables each of those actions. If it is configured correctly, the employee can finish the job without consulting IT.

The following are some of the many subjects you might want to learn about LDAP (lightweight directory access protocol), which greatly simplifies digital life:

  • What is Lightweight Directory Access Protocol (LDAP) Authentication?
    • Origins of LDAP
  • How Does LDAP Authentication Work?
  • Understanding LDAP Components
  • What's the Difference Between LDAP, OpenLDAP, and Active Directory?
  • What are the Benefits of LDAP?
  • When to Use LDAP?
  • Which Ports are Used for LDAP?
    • Is LDAP a TCP or UDP Port?
  • How can LDAP be integrated with OPNsense and pfSense for enhanced security?
  • Which Cloud Services Support LDAP?
  • What is Secure LDAP Connection?

What is Lightweight Directory Access Protocol (LDAP) Authentication?​

A software protocol called LDAP (Lightweight Directory Access Protocol) makes it possible for anybody to find information about businesses, people, and other resources like files and devices on a network, whether it be on a company intranet or the public internet. As a component of X.500, a standard for directory services in a network, LDAP is a "lightweight" version of Directory Access Protocol (DAP). Because it uses less code than other protocols, LDAP is regarded as lightweight. A directory indicates to the user where something is located on the network. The domain name system (DNS) is the directory system used on TCP/IP networks, which includes the Internet. It links a domain name to a particular network address or a distinct place on the network. It's possible that the user is unaware of the domain name. Although more information will aid in the search, LDAP enables a user to look for an individual without knowing where they are. Verifying usernames and passwords that are kept in a directory service, such as Microsoft Active Directory or OpenLDAP, is known as LDAP authentication. Within a directory, administrators have the ability to create user accounts and give them access.

The LDAP authentication server receives a request from a user when they attempt to access a resource. The username and password you submit are checked by the LDAP server against the directory's information. After determining whether a match exists, it determines if the user is permitted to access the requested resource. The two primary objectives of LDAP are data storage in the LDAP directory and user authentication for directory access. Additionally, LDAP provides the communication language that applications need to transmit and receive data from directory services. A directory service makes it possible to locate data on people, companies, and other entities on a network. Providing a central location for administering and accessing directory services is the most popular use case for LDAP. Organizations store, manage, and safeguard data about themselves, their users, and their assets, such as usernames and passwords, with the help of LDAP. This creates a hierarchical structure of information that makes storage access easier, and it may be very important for businesses as they expand and add more assets and user data.

In addition, LDAP serves as an identity and access management (IAM) solution with support for Secure Sockets Layer (SSL), Simple Authentication Security Layer (SASL), Kerberos, and single sign-on (SSO).

Origins of LDAP​

The International Telecommunication Union (ITU), situated in Geneva, is where LDAP first emerged. When the ITU started establishing email standards, it was necessary to have a directory of names (as well as other data) that could be accessible across networks in a hierarchical manner similar to DNS. The X.500 family of standards, which established the DAP (Directory Access Protocol) protocol for gaining access to a networked directory service, is the outcome of their labor.

Tim Howes and associates at the University of Michigan created LDAP in 1993. It was designed to be a low-cost, light-weight replacement for the then-used X.500 directory services protocols, like the directory access protocol (DAP).

X.500 was taxing on the systems and the network due to its massive bandwidth-intensive footprint. It makes sense that the majority of desktop PCs in the early 1990s were unable to establish a connection to an X.500 directory service. Because of this, X.500 was primarily used in systems other than PCs back then, such as mainframes, minicomputers, or microcomputers. By enabling user identification and authorization for IT resources and lowering overhead, bandwidth consumption, and endpoint demand, LDAP provided a solution to these issues. Owing to these benefits, LDAP was quickly adopted as the standard authentication protocol for Internet directory services and had considerable success.

In the latter part of the 1990s, LDAP version 3 was put forth and approved as the internet standard for directory services. This is still the most recent and widely used version of LDAP available today.

Kurt Zeilenga launched the OpenLDAP Project in 1998 with the release of OpenLDAP 1.0, following this significant achievement. Bug fixes, improved platform support, and enhanced security features were all incorporated in this release. Additionally, it was the first client-server application suite built using LDAPv3.3 that was completely open-source.

OpenLDAP was popular because, among other things, it allowed IT administrators to alter it to better suit their organizations' requirements. Since 1999, Howard Chu and the Symas team have been leading the development of OpenLDAP. Microsoft released Active Directory in 1999, which kept businesses within the Microsoft environment by utilizing proprietary extensions with LDAP and Kerberos. Since then, LDAP has had a major influence on the development of directory services and has grown to be a crucial part of contemporary IT architecture.

How Does LDAP Authentication Work?​

A client/server bind process is necessary for LDAP authentication. This makes it possible for the directory server (also called the directory system agent, or DSA) and the LDAP-ready client (also called the directory user agent, or DUA) to talk to each other in a safe, encrypted session.

The user is required to enter their username and password while logging in to the database via an LDAP server. The LDAP server provides the user access to the IT resource in question if the values the user enters into the client match those in the LDAP database. The following important parties are involved in the client-server model of authentication, which is the LDAP authentication process:

  • Directory System Agent (DSA): A server with LDAP installed on its network
  • Directory Users Agent (DUA): Uses a client to access DSAs (such as a user's PC).
  • DNS: The distinguished name, which includes a path for LDAP to follow through the directory information tree (DIT) (ex. cn=Susan, ou=users, o=Company),
  • Relative Distinguished Name (RDN): Every element in the path inside the DN (for example, cn=Susan)
  • API stands for Application Programming Interface: Enables your good or service to interact with other goods and services without needing to be aware of how they're used

The procedure begins when a user attempts to use a PC to access an LDAP-enabled client program, such as a business email application. Users using LDAPv3 have to choose between two alternative user authentication methods: SASL authentication, which connects the LDAP server to software such as Kerberos, or basic authentication, such as SSO using login credentials. A request to authenticate the user's allocated DN is sent upon attempting to log in. The client API or service that initiates the DSA sends the DN.

LDAP uses the DN to search for the matching object or set of objects against the records in the LDAP database when the client automatically binds to the DSA. At this point, the RDNs in the DN are crucial since they offer every step that LDAP needs to find the person through the DIT. The result can appear invalid if the path does not have a connecting RDN on the backend. Here, the individual user account (cn=Susan) is the item that LDAP is looking for, and it can only authenticate the user if the account in the directory has the same user ID and password. Additionally, user groups are recognized as objects in the LDAP directory.

Upon receiving a response, whether legitimate or invalid, the client disconnects from the LDAP server. Based on the permissions given by the system administrator, authenticated users can then access the API and its services, including the required files, user data, and other application data.

Understanding LDAP Components​

TCP/IP is used by LDAP. A distributed database application called a directory service is made to handle the entries and properties in a directory. Clients using LDAP can access various directory services according to entries. Depending on access controls, users and other apps can access these LDAP entries. LDAP's constituent parts are outlined below.

Structure of LDAP Directory

A distributed database application called a directory service is used to handle the entries and properties in a directory. Users and other programs can access the entries and characteristics through a directory service. One instance of a directory service is the OpenLDAP server. Microsoft Active Directory and Sun Microsystems' Sun Active Directory Service are two additional directory services.

The LDAP protocol is used by directory clients to connect to directory services. To access the directory service, a directory client can utilize any of the accessible client APIs.

Figure 1. LDAP Directory Structure

A directory is arranged in tree form. The root entry is the entry at the top of a directory. Typically, this entry serves as a representation of the directory's owner's organization.

Larger organizations or groupings are represented by entries at higher levels of the hierarchy. Smaller organizations that comprise the larger ones are represented by entries under the larger organizations. The resources or people are represented by the leaf nodes, sometimes called entries, in the tree structure.

The relationships and interactions between a few predefined structural components greatly influence how LDAP presents data to users. Fundamental LDAP Data Elements are outlined below:

  • Attributes: In an LDAP system, the data is mostly saved in elements known as attributes. In essence, attributes are key-value pairs. In contrast to many other systems, the object classes chosen for entry determine the preset names of the keys. An attribute's data must correspond to the type specified in the attribute's original declaration. When setting an attribute's value, the attribute name and value are entered, separated by a colon and a space. The following is an illustration of the mail attribute, which defines an email address:

    Instead, an equals sign joins the two sides when referring to an attribute and its data (without setting it):

    • mail=example.com

    In an LDAP system, the majority of the real data you wish to save and retrieve is contained in the attribute values. Structure, organization, and other features are provided by the other LDAP components.

  • Entries: Features are not very useful on their own. They have to be connected to something in order to have meaning. You use attributes within an entry in LDAP. A collection of characteristics grouped together under a name to describe something is what makes up an entry.

    For example, every item in your inventory or every person in your system can have an entry. This can be approximately compared to a single page in an address book or a row in a relational database system (the characteristics above would reflect the various fields in each of these models). An entry only groups these attributes together under a name to describe the item itself, whereas an attribute identifies a quality or characteristic of something.

  • DIT: It is easy to realize that the data defined by attributes only contains a portion of the information that is available about an object as you get familiar with LDAP. The location of the entry within the LDAP system and the relationships that follow are found.

    For example, how would someone be able to distinguish between an inventory item and a user entry if that were possible? Creating groups and relationships between entries is one technique to distinguish between entries of various types. This mostly depends on the location of the entry at the time of creation. An LDAP system stores entries as branches on trees known as Data Information Trees, or DITs.

    With the exception of the top-level entry, each entry in a DIT reflects an organizational structure akin to a file system, where each entry has exactly one parent entry and may have any number of child entries beneath it. Some entries in an LDAP tree will be used only for organizational purposes, much like directories in a filesystem, because entries in an LDAP tree can represent almost anything.

    You might have two entries in this manner: one for "people" and another for "inventory items". To help you identify between their types more clearly, your real data entries could be made as children of these. You are free to define your organizational entries however you see fit to effectively represent your data.

    One instance of the DIT is shown in the dn line of the example entry in the previous section:

    • dn: dc=mycompany,dc=com,ou=people,sn=John

    The entry is identified by this line, which is also known as its distinguishing name (more on this later). It serves as a complete route back to the DIT's origin. We are creating an entry in this case with the name "John�. The entry ou=people, which is likely being used as a container for entries describing people, is the immediate parent. The domain name �mycompany.com�, which serves as the foundation of our DIT, is where the parents of this item originated.

What's the Difference Between LDAP, OpenLDAP, and Active Directory?​

OpenLDAP and Active Directory are examples of software that uses the LDAP protocol. LDAP is a protocol. It is helpful to first grasp the LDAP protocol in order to comprehend the distinctions among LDAP, OpenLDAP, and Active Directory. We first explain the primary difference between LDAP and MS Active Directory.

Active Directory vs. LDAP​

The foundational protocol for Microsoft's Active Directory (AD) directory service, which includes data from each user account on a network, is LDAP; however, it is not the only one.

The number of attributes in the database is greater than what is retrieved from LDAP. However, since LDAP is skilled at locating directory objects with sparse data, it doesn't have to retrieve every property from AD or the directory service it is obtaining data from.

LDAP and Active Directory are two different products; LDAP is a standard application protocol, and AD is a proprietary one. An interface called LDAP is used to communicate with directory services like AD. On the other hand, AD offers identity and access management (IAM) services and a database.

An LDAP server is used by LDAP to communicate with directories. To store the identification information needed for user authentication in an application, several businesses employ LDAP servers. People occasionally mix up the two approaches or refer to them as "LDAP Active Directory" or "Active Directory LDAP" because AD is also used to store identity data. The fact that AD and LDAP are interoperable contributes to the misunderstanding that misidentifies Active Directory as LDAP.

Communicating with, storing, and extracting objects (such as domains, users, groups, etc.) from AD into a format that is readable for its own directory on the LDAP server is the primary objective of LDAP.

OpenLDAP vs. LDAP​

An open-source, free implementation of the LDAP protocol is called OpenLDAP. OpenLDAP is commonly referred to as simply "LDAP" since it's a widely used, open version that anyone can use. But it's not just the protocol; it's also a lightweight LDAP directory program.

Any platform can use OpenLDAP. OpenLDAP is an LDAP solution that is extremely focused and customizable, supporting all main computer platforms, as opposed to other implementations that offer more comprehensive features like a GUI and often a suite of other protocols and functionality (sometimes at a cost).

Although this flexibility sounds good (and it usually is), too much latitude can occasionally make the program harder to use. Some believe that OpenLDAP demonstrates this, especially given its lack of a graphical user interface. It may take a great deal of experience to manage and implement.

Active Directory vs. OpenLDAP​

For Windows-based network, device, application, and file access, Microsoft AD is a directory service that centrally maintains user and device account data.

Compared to OpenLDAP, AD has more functionality, such as a graphical user interface and more capable setup tools like Group Policy Objects for Windows devices. Moreover, AD employs additional protocols in addition to LDAP, whereas OpenLDAP solely utilizes the LDAP standard. Actually, AD mostly uses its version of Kerberos; LDAP is not its main protocol.

OpenLDAP has a significantly deeper understanding of the LDAP protocol than AD does, despite AD appearing to be more robust overall due to its exclusive focus on the protocol.

Naturally, the price difference between OpenLDAP and AD is due to the former's greater capability and the latter's commercial nature: OpenLDAP is free, whereas AD is not.

Because AD operates on premise, a license is required, and AD hardware and maintenance can be expensive. Additionally, OpenLDAP is more adaptable and adjustable in terms of implementation, even though AD offers greater capabilities outside of the LDAP protocol.

OpenLDAP is undoubtedly less feature-rich than Active Directory, which provides a more scalable Identity Access Management (IAM) solution. Still, OpenLDAP's exclusive concentration on the LDAP protocol affords it significantly more depth when it comes to LDAP implementation, even though Active Directory may appear more feature-rich overall.

What are the Benefits of LDAP?​

Thousands of users are usually managed at once by enterprise network administrators. This implies that they are in charge of allocating policies and access controls according to a user's role and permission to access files for routine operations, such as using an intranet for the business.

LDAP centralizes the authentication process, streamlines user management, and saves network administrators a ton of time.

Although OpenLDAP is an open-source program for Windows, Red Hat Directory Servers on UNIX and other tools and client environments can also use LDAP for user authentication. Moreover, role-based access control (RBAC), API administration, and other services and applications like Docker and Kubernetes can benefit from LDAP's authentication and user management features.

Thus, despite the emergence of more modern options, LDAP authentication is still widely used by enterprises for a variety of reasons. Most notably, LDAP is an open-standard protocol that runs on many different systems and applications. This helps prevent vendor lock-in and makes it possible for an organization to use LDAP across a wide range of systems and applications.

Additionally, LDAP is rather flexible. It can be used to store data on organizational structure and network-connected assets, in addition to important organizational traits like usernames and passwords. This facilitates the management and protection of user identities and guarantees that staff members have easy access to all the resources they require to carry out their work well.

When to Use LDAP?​

LDAP protocol is used for the following purposes:

  • Keep user information in a single, easily accessible location.
  • Assign those users to resources that they are permitted to utilize.
  • Verify user identity and grant access to the resources they have been allocated, such as:
    • Technical Applications: LDAP is the best authentication method for Jenkins, Docker, OpenVPN, the Atlassian suite, and many other applications.
    • Infrastructure of the server: LDAP is used by Linux servers, both on-premises and in the cloud (such as AWS), to authenticate users.
    • File Servers: LDAP is supported by file servers such as FreeNAS, Synology, and QNAP.
    • Networking Equipment: Some businesses utilize LDAP for network access via VPNs, WiFi access points, and other networking equipment, even though this can overlap with the RADIUS protocol.

When LDAP was first introduced, its features were significantly more advanced than those of competing solutions. An increasing number of IT resources became LDAP-compatible as the protocol gained traction. To facilitate access to those resources, new services, including comprehensive directory services, alternative authentication protocols, and cloud LDAP, also appeared.

IT administrators can now control access to legacy apps, networks, NAS, and other components both on-premises and in the cloud by using LDAP to authenticate computers. They can integrate this feature with other protocols to provide consumers access to almost all of their IT resources using cloud directory services.

Additionally, LDAP's ability to query directory information makes single sign-on (SSO), which uses a user's already existing account in a directory to authenticate them to an application or service, possible. Many organizations still utilize LDAP to provide SSO capabilities, even though more recent protocols like OAuth2 and SAML are increasingly used in contemporary SSO installations.

Apart from authentication, we can query the directory using LDAP for informational reasons to find user attributes such as employee ID, department or title information, group membership, and access control lists, among other things. Updates to the directory can also be made, depending on the user's level of access to the LDAP directory. LDAP allows us to change, add, or remove directory entries.

Which Ports are Used for LDAP?​

While alternative ports can be utilized, 389 is the default port for LDAP connections. For example, choose an unprivileged port, 1389 by default, if you need to be able to start the server as an ordinary user. Privileged access is necessary for port numbers lower than 1024. Run some LDAP commands as root if you use a port number smaller than 1024.

Different ports are available for connections to an LDAP server based on whether an encrypted or unencrypted connection is needed.

The TCP ports 389 and/or 636 should be used. LDAPS, or LDAP over SSL, uses port 636. Alternatively, you can use the STARTTLS protocol to encrypt data on port 389, but in that scenario, you need to make sure that encryption is occurring.

Is LDAP a TCP or UDP Port?​

LDAP is often a TCP protocol. But Microsoft also employs LDAP using TCP.

Active Directory only allows UDP searches for queries against rootDSE. Similar to how a search over TCP is encoded, it encodes the results of an LDAP search over UDP as one or more SearchResultEntry messages followed by a SearchResultDone message, as [RFC2251] describes. This indicates that the search result is not encoded in the way that [RFC1798] specifies. Active Directory only supports LDAP search and LDAP abandon actions over UDP.

UDP and TCP are supported by LDAPS, with TCP being the most widely used query protocol. Again, if you have a Windows domain server with Active Directory enabled, you will need both TCP and UDP, as Microsoft Active Directory requires both protocols.

In conclusion, the transport protocol used by LDAP is usually either TCP or UDP (also known as CLDAP).

How can LDAP be integrated with OPNsense and pfSense for enhanced security?​

Organizations can improve system security and protect sensitive data by knowing the principles of LDAP authentication and the difficulties involved in implementing it.

As technology continues to progress, LDAP authentication is essential to maintaining safe user access on a variety of platforms and apps.

Based on FreeBSD, pfSense is a popular open-source firewall and router platform. It provides strong firewall protection, a user-friendly web interface, VPN support, and package extensions for more functions. The scalability and flexibility of pfSense software are well-known. Many aspects of pfSense are shared by OPNsense, which is a fork of pfSense. Along with support for plugins and add-ons, it offers firewall and routing features. OPNsense strives for a user-centric and community-driven approach to development.

OPNsense and pfSense employ an LDAP server to facilitate authentication and authorization with respect to graphical user interface components, specifically the web configurator. To establish privileges for the graphical user interface (GUI) via LDAP, it is necessary for the local user manager to integrate the users from the LDAP source.

An organization with multiple locations uses G Suite Enterprise for email and storage but does not wish to operate a local LDAP server. Nevertheless, the organization desires to implement centralized authentication for firewalls across all sites. Organizations may additionally implement LDAP authentication on OPNsense or on pfSense for their captive portal, virtual private network (VPN), or squid caching proxy users. The main steps of configuring an OPNsense firewall to utilize G Suite LDAP authentication are given below:

  1. Configure the LDAP Application on the G Suite admin portal
  2. Download the certificate, key, username and password
  3. Import the certificate and key
  4. Install the stunnel package on OPNsense
  5. Configure the stunnel package
  6. Configure LDAP authentication on OPNsense
  7. Test G Suite LDAP Authentication
  8. Use G Suite LDAP for Administrative Logins
  9. Importing G Suite LDAP Users

Which Cloud Services Support LDAP?​

With their varied range of operating systems, many firms can no longer afford to use AD's Microsoft Windows and Azure-centric approach. As a result, they are now depending on more integrated solutions, including cloud LDAP and directory-as-a-service, to manage their expanding infrastructure.

Businesses are greatly relieved of the load of directory management when they use cloud LDAP. This includes everything from configuring and maintaining the fundamental directory infrastructure to incorporating systems and apps into its LDAP-based identity provider. Businesses can send their LDAP-connected endpoints to the servers since they are primed and prepared with cloud LDAP.

Certain cloud LDAP services come with a graphical user interface (GUI) and technical assistance when required, so there's no need to use plain-text code for every activity. However, certain directory services continue to offer the convenience of command-line execution, which is very useful for large-scale tasks.

In light of all of this, many IT administrators are looking for cloud-hosted LDAP alternatives they can use due to the challenges of on-premises LDAP. Let's examine a few of the potential choices. The primary cloud services that support LDAP are outlined below:

  1. Google Cloud: Users may be authenticated via the Google Cloud Identity LDAP (Lightweight Directory Access Protocol) service. By utilizing the Google Secure LDAP service, one can establish a secure and uncomplicated connection between LDAP-based applications and services and Google Workspace or Cloud Identity. When Secure LDAP is utilized, Cloud Directory can operate as a cloud-based LDAP server for the purposes of authentication, authorization, and directory lookups. Organizations that have previously transferred their email and drive storage to Google are now able to utilize the service for LDAP-based authentication. In order to eliminate the necessity of maintaining distinct authentication services on-premises and within Google Workspace.

  2. Azure AD Connect: Microsoft's solution, Azure AD Connect, is designed to take the place of LDAP for cloud authentication. Through the integration of Azure AD with your on-premises directories, Azure AD Connect offers a single identity for cloud and on-premises resource access. "Pass-through authentication" is one of Azure AD Connect's primary features. A single password can be used both on-premises and in the cloud with pass-through authentication, an LDAP substitute that eliminates the need for extra infrastructure related to a single centralized network environment.

  3. JumpCloud: JumpCloud is a provider of LDAP-as-a-Service. IT administrators can take advantage of their creatively titled Cloud LDAP service, which is a worldwide distributed network of OpenLDAP servers, by connecting their storage and application infrastructure to the network.

Secure keys can be used by managed devices and apps to establish a connection with JumpCloud's servers, where they can authenticate and approve user logins. This reduces the requirement for an LDAP specialist, which results in maintenance cost savings for enterprises.

What is Secure LDAP Connection?​

Standard security is offered by LDAP authentication, which includes an integrated access control layer. It is still possible for malicious actors to intercept data being transmitted between clients and Active Directory. Enhance security by integrating SSL/TLS encryption into the LDAP authentication procedure. This reduces the vulnerability of data transferred during the authentication process by encrypting connections.

There is no security associated with the default LDAP port (389), which is used for authentication. Add security extensions, like the LDAPv3 TLS extension or StartTLS mode, to establish a secure connection. In order to improve the security of the directories, businesses might take into account additional security measures. These security best practices consist of:

  • Encrypting LDAP queries and answers with TLS/SSL.
  • Not keeping passwords in cleartext when LDAP authentication is in place. Businesses can employ cryptographically robust hash functions as an alternative.
  • Maintaining the various reflections of the directory data to avoid a single point of failure.
  • Defining a precise policy for access control. As an illustration, only allowing administrators access and prohibiting everybody else from doing so.
  • Monitoring anomalies and recording LDAP directory access.
  • Utilizing properly designed firewalls to guarantee improved access control for directory services.
Last updated on by Zenarmor