LDAP
Lightweight Directory Access Protocol. A protocol for querying and modifying a hierarchical directory of entries, each identified by a distinguished name. Used to read users, groups, and attributes, and to authenticate by binding as a user with their password.
LDAP predates the modern identity stack and still underpins it. Active Directory, OpenLDAP, and most directory products speak it, and a large amount of legacy application authentication is still an LDAP bind. That is worth understanding precisely, because an LDAP bind means the application receives the user's actual password, which is exactly what SAML, OIDC, and Kerberos were designed to avoid. Migrating those applications to a federation protocol is usually the highest-value step in an identity modernization.
See also: Active Directory, SAML, OIDC, identity provider
Related on Start with Identity
- GlossaryAuthorization Server
In OAuth 2.0, the component that authenticates the resource owner, obtains their authorization, and issues access tokens to clients. It exposes the authorizatio
- GlossaryKerberos
A ticket-based network authentication protocol using symmetric cryptography and a trusted third party, the Key Distribution Center. A client authenticates once,
- GlossaryNTLM
A challenge-response authentication protocol used by Windows before Kerberos and still present as a fallback. The client proves knowledge of a password hash wit
- CVEHashiCorp Vault LDAP auth username enumeration
Vault's LDAP auth method returned different errors for unknown and known users. Enumeration is how a lockout or MFA-bypass chain starts. Fixed in 1.14.1 and the
- CVELDAPNightmare, domain-controller DoS via crafted LDAP response
A crafted LDAP response crashes the Windows LDAP client and can take a domain controller down. SafeBreach published a PoC in January 2025. High. Patched Decembe
- ArticleTop 6 Open-Source Directory Services and LDAP Servers
The best open-source directory servers in 2026, from OpenLDAP and 389 Directory Server to FreeIPA, Samba AD, Kanidm, and LLDAP, compared on protocol support, Ac