LDAP clients can authenticate to a server and search, compare, add, modify, or delete entries organized in a hierarchical directory information tree. LDAPv3 defines the wire protocol and related schema, naming, security, and extension specifications.
Each entry has a distinguished name and a set of typed attributes governed by schemas. A client can bind anonymously, with a name and password, or through a Simple Authentication and Security Layer (SASL) mechanism, then perform operations allowed by server policy. Transport Layer Security (TLS), commonly established with StartTLS, protects the confidentiality and integrity of directory exchanges when correctly configured and verified.
Key points
Directory roleUse LDAP to query and maintain structured identity, group, device, service, and configuration records; define authoritative sources and ownership outside the protocol.
Access controlsRestrict reads and writes at suitable entry and attribute granularity, protect administrative binds, and prevent broad searches from exposing sensitive directory data.
Secure operationRequire acceptable transport protection before name-and-password binds, validate server identity, handle referrals carefully, monitor changes, and test schema and replication behavior.
Important limitationLDAP is a protocol, not an identity-governance program or a complete directory product. A successful bind does not grant universal access, and stale records, excessive directory permissions, or insecure non-LDAP access to the backing store remain risks.