LDAP (Lightweight Directory Access Protocol) is a protocol used to access and manage directory services over a network. It is commonly used to authenticate users, query user information, and manage resources in a hierarchical directory structure, such as AD. LDAP enables centralized management of user accounts and permissions, facilitating secure and efficient access to networked resources.
Key points about LDAP
- Hierarchical Structure
LDAP directories are organized in a hierarchical, tree-like structure called the Directory Information Tree (DIT). Each entry in the directory is identified by a Distinguished Name (DN), which uniquely identifies its location within the DIT.
- Entries and Attributes
Each entry in an LDAP directory consists of a set of attributes. An attribute is a pair consisting of a type (like “name” or “email”) and one or more values. For example, an entry for a user might have attributes for their name, email address, and phone number.
- Distinguished Name (DN)
This is a unique identifier for each entry in the directory, it’s a combination of the entry’s name and its position in the directory hierarchy.
- Schema
LDAP uses a schema to define the types of entries and the attributes they can have, ensuring data consistency and allowing the enforcement of rules regarding the structure and content of the directory entries.
- Authentication and Authorization
LDAP supports authentication, allowing users to prove their identity, and authorization, determining what resources authenticated users are allowed to access.
- LDAP Operations
Common operations include searching for entries, adding new entries, deleting entries, and modifying existing entries. These operations allow administrators and applications to interact with the directory service efficiently.
It can be used with a network authentication protocol like RADIUS, when a user attempts to access a network service like a VPN or WIFI their device sends an authentication request to the RADIUS server and it sends a query to the LDAP to verify the user’s credentials, if it’s successful the employee is granted access to the network.
