Cybersecurity glossary
What is LDAP?
Learn what LDAP is, how directories store users and groups for authentication and authorization, common LDAP security risks including injection, and hardening best practices.
Definition
LDAP (Lightweight Directory Access Protocol) is a standard application protocol for reading and modifying hierarchical directory information—commonly user accounts, groups, and organizational attributes—used by identity systems and applications for lookups and sometimes authentication.
Why directories still sit under modern IAM
Even when users sign in with OIDC or SAML, something authoritative still stores who they are and which groups they belong to. LDAP is the classic protocol applications and identity platforms use to query that hierarchical directory.
Understanding LDAP helps you secure the identity store behind SSO—and avoid injecting user input into directory filters.
What LDAP provides
Hierarchical entries
Objects arranged under DNs such as users, groups, and organizational units.
Search and read
Applications query attributes like mail, memberOf, and employee IDs.
Bind authentication
Clients can authenticate by binding as a user DN with a password.
Modify operations
Provisioning tools add users, reset attributes, or change group membership.
Schema
Defines object classes and attributes the directory will accept.
Access controls
Directory ACLs decide who can read or write which attributes.
Common application integration pattern
Service binds
The application authenticates to LDAP with a dedicated service account.
Search for the user
A filter looks up the account by email or uid from login input.
User bind or password verify
Some apps attempt a bind as the found DN to verify the password.
Read groups and attributes
Authorization decisions consume group membership and profile fields.
Cache carefully
Apps may cache results; stale group data can overshare or lock out.
Security issues to expect
| Issue | Symptom | Fix |
|---|---|---|
| Cleartext LDAP | Credentials visible on the network | LDAPS or StartTLS everywhere |
| LDAP injection | Filter bypass or data leak | Encode/escape input; parameterized filters |
| Anonymous or broad reads | Directory harvesting | Tighten ACLs; disable anon bind |
| Overpowered service accounts | App compromise becomes domain-wide | Least-privilege bind DN |
Hardening checklist
- Require TLS for all LDAP binds and searches; disable plaintext where possible.
- Escape user input in LDAP filters; never concatenate raw strings into queries.
- Use dedicated, least-privilege service accounts per application.
- Disable anonymous binds unless a tightly scoped public need exists.
- Limit which attributes applications can read—especially secrets and PII.
- Monitor unusual search volumes that indicate directory reconnaissance.
- Prefer IdP/SCIM integrations over exposing LDAP to every SaaS vendor.
- Keep directory servers patched and backed up like Tier-0 identity assets.
The practical takeaway
LDAP is the workhorse protocol for directory lookup and many enterprise identity integrations. It is not obsolete—it is often the hidden backend behind modern SSO.
Encrypt it, escape filters, minimize service-account power, and treat the directory as a crown-jewel identity store rather than a casual database.
Related security terms
Identity and Access Management (IAM)
Programs that often rely on LDAP directories as identity stores.
Kerberos
Authentication protocol frequently paired with LDAP-backed directories.
Identity Provider (IdP)
May synchronize or authenticate against LDAP directories.
System for Cross-Domain Identity Management (SCIM)
Modern provisioning protocol often used instead of direct LDAP to SaaS.
Authentication
LDAP simple bind is one historical authentication method.
Frequently asked questions
What is LDAP in simple terms?
LDAP is a way for applications to look up and update information in a company directory—like usernames, email addresses, and group membership—over the network.
Is LDAP the same as Active Directory?
No. Active Directory is a directory product/service that speaks LDAP (and other protocols). LDAP is the access protocol many directories implement.
How does LDAP authentication work?
A common pattern is an LDAP bind: the client supplies a distinguished name (DN) and password. Applications may also search the directory after binding with a service account.
What is LDAP injection?
Similar to SQL injection: untrusted input is concatenated into LDAP filters, letting attackers alter queries to bypass auth checks or extract directory data.
Should LDAP be used without encryption?
No on untrusted networks. Use LDAPS or StartTLS so credentials and directory data are not exposed in transit.
Why do modern apps prefer SCIM or IdP federation?
Exposing LDAP directly to many SaaS tools is operationally heavy and risky. SCIM and SSO keep the directory behind controlled connectors.
What should be locked down on LDAP servers?
Anonymous binds, broad read ACLs, weak cipher suites, overly powerful service accounts, and unpatched directory servers.
References
Explore authoritative guidance and frameworks related to ldap.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.