# What is Lightweight Directory Access Protocol (LDAP)?

> Lightweight Directory Access Protocol (LDAP) is an IETF protocol for accessing and managing information in a distributed directory service.

- Canonical URL: https://yellowcube.eu/glossary/lightweight-directory-access-protocol/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

LDAP clients can authenticate to a server and search, compare, add, modify, or delete entries organized in a hierarchical directory information tree. LDAPv3 defines the wire protocol and related schema, naming, security, and extension specifications.

Each entry has a distinguished name and a set of typed attributes governed by schemas. A client can bind anonymously, with a name and password, or through a Simple Authentication and Security Layer (SASL) mechanism, then perform operations allowed by server policy. Transport Layer Security (TLS), commonly established with StartTLS, protects the confidentiality and integrity of directory exchanges when correctly configured and verified.

### Key points

- **Directory role:** Use LDAP to query and maintain structured identity, group, device, service, and configuration records; define authoritative sources and ownership outside the protocol.
- **Access controls:** Restrict reads and writes at suitable entry and attribute granularity, protect administrative binds, and prevent broad searches from exposing sensitive directory data.
- **Secure operation:** Require acceptable transport protection before name-and-password binds, validate server identity, handle referrals carefully, monitor changes, and test schema and replication behavior.
- **Important limitation:** LDAP is a protocol, not an identity-governance program or a complete directory product. A successful bind does not grant universal access, and stale records, excessive directory permissions, or insecure non-LDAP access to the backing store remain risks.

### Related terms

[Active Directory (AD)](<https://yellowcube.eu/glossary/active-directory/>) · [Authentication](<https://yellowcube.eu/glossary/authentication/>) · [Authorization](<https://yellowcube.eu/glossary/authorization/>) · [System for Cross-domain Identity Management (SCIM)](<https://yellowcube.eu/glossary/system-for-cross-domain-identity-management/>) · [Kerberos authentication](<https://yellowcube.eu/glossary/kerberos-authentication/>)

### Sources

[RFC 4510: LDAP Technical Specification Road Map](https://datatracker.ietf.org/doc/html/rfc4510) · [RFC 4511: LDAP—The Protocol](https://datatracker.ietf.org/doc/html/rfc4511) · [RFC 4513: LDAP Authentication Methods and Security Mechanisms](https://datatracker.ietf.org/doc/html/rfc4513)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.