LDAP
Lightweight Directory Access Protocol. A protocol for querying and modifying a hierarchical directory of entries, each identified by a distinguished name. Used to read users, groups, and attributes, and to authenticate by binding as a user with their password.
LDAP predates the modern identity stack and still underpins it. Active Directory, OpenLDAP, and most directory products speak it, and a large amount of legacy application authentication is still an LDAP bind. That is worth understanding precisely, because an LDAP bind means the application receives the user's actual password, which is exactly what SAML, OIDC, and Kerberos were designed to avoid. Migrating those applications to a federation protocol is usually the highest-value step in an identity modernization.
See also: Active Directory, SAML, OIDC, identity provider, directory service
Related on Start with Identity
- GlossaryAuthorization Server
In OAuth 2.0, the component that authenticates the resource owner, obtains their authorization, and issues access tokens to clients. It exposes the authorizatio
- GlossaryCross App Access (XAA)
Cross App Access (XAA) is the informal name for the OAuth pattern, specified in the IETF draft Identity Assertion JWT Authorization Grant ([draft-ietf-oauth-ide
- GlossaryKerberos
A ticket-based network authentication protocol using symmetric cryptography and a trusted third party, the Key Distribution Center. A client authenticates once,
- PodcastEntra.Chat
A weekly show for Microsoft Entra administrators, with deployment stories from practitioners and the engineers who build the product. Hosted by a Microsoft empl
- PodcastSemperis
Semperis' biweekly show for defenders of hybrid Active Directory and Entra ID environments, hosted by 15-time Microsoft MVP Sean Deuby.
- CVEFreeIPA anonymous LDAP write plants a Kerberos principal in the admins group
FreeIPA's self-managed OTP token ACI let an anonymous LDAP client create a token entry with extra attributes, which combined with a 389 Directory Server ACI fla