Lightweight Directory Access Protocol - Revision history

imported>Kvng: lead: MOS:TERM. format RFC links. WP:DUPLINK.

2025-11-17T18:31:35Z

lead: MOS:TERM. format RFC links. WP:DUPLINK.

← Previous revision		Revision as of 18:31, 17 November 2025
Line 5:		Line 5:
	\| based on = [[X.500]]		\| based on = [[X.500]]
	\| ports = 389 (ldap), 636 (ldaps)		\| ports = 389 (ldap), 636 (ldaps)
	\| rfcs = RFC 4510~~, RFC~~ 4511		\| rfcs = {{IETF RFC\|4510\|4511\|plainlink=yes}}
	}}		}}
	{{IPstack}}		{{IPstack}}
	The '''Lightweight Directory Access Protocol''' ('''LDAP''' {{IPAc-en\|ˈ\|ɛ\|l\|d\|æ\|p}}) is an open, vendor-neutral, industry standard [[application protocol]] for accessing and maintaining distributed [[Directory service\|directory information services]] over an [[Internet Protocol]] (IP) network.<ref>{{cite web\|url=https://tools.ietf.org/rfc/rfc4511.txt \|title=Network Working Group RFC 4511 \|publisher=IETF.org \|date=2006-06-01\|access-date=2014-04-04}}</ref> [[Directory service]]s play an important role in developing [[intranet]] and Internet applications by allowing the sharing of information about users, systems, networks, services, and applications throughout the network.<ref>{{cite web \|url=https://docs.oracle.com/cd/A87860_01/doc/ois.817/a83729/adois09.htm \|title=Directory Services LDAP \|publisher=Oracle.com \|access-date=2014-04-04}}</ref> As examples, directory services may provide any organized set of records, often with a hierarchical structure, such as a corporate [[email]] directory. Similarly, a [[telephone directory]] is a list of subscribers with an address and a phone number.

	LDAP is specified in a series of [[Internet Engineering Task Force]] (IETF) ~~Standard Track~~ publications known as [[Request for Comments]] (RFCs), using the description language [[ASN.1]]. The latest specification is Version 3, published as ~~[https://datatracker.ietf.org/doc/html/rfc4511~~ RFC 4511]<ref name="gracion">[http://www.gracion.com/server/whatldap.html What is LDAP?]. Gracion.com. Retrieved on 2013-07-17.</ref> (a road map to the technical specifications is provided ~~by [https://tools.ietf.org/html/rfc4510 RFC4510])~~.		The '''Lightweight Directory Access Protocol''' ('''LDAP''' {{IPAc-en\|ˈ\|ɛ\|l\|d\|æ\|p}}) is an open, vendor-neutral, industry standard [[application protocol]] for accessing and maintaining distributed [[Directory service\|directory information services]] over an [[Internet Protocol]] (IP) network.<ref>{{cite web\|url=https://tools.ietf.org/rfc/rfc4511.txt \|title=Network Working Group RFC 4511 \|publisher=IETF.org \|date=2006-06-01\|access-date=2014-04-04}}</ref> Directory services play an important role in developing [[intranet]] and Internet applications by allowing the sharing of information about users, systems, networks, services, and applications throughout the network.<ref>{{cite web \|url=https://docs.oracle.com/cd/A87860_01/doc/ois.817/a83729/adois09.htm \|title=Directory Services LDAP \|publisher=Oracle.com \|access-date=2014-04-04}}</ref> As examples, directory services may provide any organized set of records, often with a hierarchical structure, such as a corporate [[email]] directory. Similarly, a [[telephone directory]] is a list of subscribers with an address and a phone number.

			LDAP is specified in a series of [[Internet Engineering Task Force]] (IETF) publications known as [[Request for Comments]] (RFCs), using the description language [[ASN.1]]. The latest specification is Version 3, published as {{IETF RFC\|4511\|link=no}}<ref name="gracion">[http://www.gracion.com/server/whatldap.html What is LDAP?]. Gracion.com. Retrieved on 2013-07-17.</ref> and a road map to the technical specifications is provided in {{IETF RFC\|4510\|link=no}}.

	A common use of LDAP is to provide a central place to store usernames and passwords. This allows many different applications and services to connect to the LDAP server to validate users.<ref>{{cite web\|title=Introduction to OpenLDAP Directory Services\|url=http://www.openldap.org/doc/admin24/intro.html\|website=OpenLDAP\|access-date=1 February 2016}}</ref>		A common use of LDAP is to provide a central place to store usernames and passwords. This allows many different applications and services to connect to the LDAP server to validate users.<ref>{{cite web\|title=Introduction to OpenLDAP Directory Services\|url=http://www.openldap.org/doc/admin24/intro.html\|website=OpenLDAP\|access-date=1 February 2016}}</ref>

	LDAP is a simpler ("lightweight") subset of the standards in the [[X.500\|X.500 series]], particularly the X.511 [[Directory Access Protocol]].{{ref RFC\|4511\|quote=The core protocol operations defined in this document can be mapped to a subset of the X.500 (1993) Directory Abstract Service [X.511]. However, there is not a one-to-one mapping between LDAP operations and X.500 Directory Access Protocol (DAP) operations.}}<ref>{{cite web \|url=https://www.redhat.com/en/topics/security/what-is-ldap-authentication \|title=What is lightweight directory access protocol (LDAP) authentication? \|publisher=[[Red Hat]] \|date=3 June 2022}}</ref> Because of this relationship, LDAP is sometimes called ''X.500 Lite''.<ref>{{cite web\|url=http://www.webopedia.com/TERM/L/LDAP.html \|title=LDAP - Lightweight Directory Access Protocol \|date=4 December 1996 \|publisher=Webopedia.com \|access-date=2014-04-05}}</ref>		LDAP is a simpler (''lightweight'') subset of the standards in the [[X.500\|X.500 series]], particularly the X.511 [[Directory Access Protocol]].{{ref RFC\|4511\|quote=The core protocol operations defined in this document can be mapped to a subset of the X.500 (1993) Directory Abstract Service [X.511]. However, there is not a one-to-one mapping between LDAP operations and X.500 Directory Access Protocol (DAP) operations.}}<ref>{{cite web \|url=https://www.redhat.com/en/topics/security/what-is-ldap-authentication \|title=What is lightweight directory access protocol (LDAP) authentication? \|publisher=[[Red Hat]] \|date=3 June 2022}}</ref> Because of this relationship, LDAP is sometimes called '''X.500 Lite'''.<ref>{{cite web\|url=http://www.webopedia.com/TERM/L/LDAP.html \|title=LDAP - Lightweight Directory Access Protocol \|date=4 December 1996 \|publisher=Webopedia.com \|access-date=2014-04-05}}</ref>

	==History==		==History==
Line 55:		Line 56:
	A DN may change over the lifetime of the entry, for instance, when entries are moved within a tree. To reliably and unambiguously identify entries, a [[UUID]] might be provided in the set of the entry's ''operational attributes''.		A DN may change over the lifetime of the entry, for instance, when entries are moved within a tree. To reliably and unambiguously identify entries, a [[UUID]] might be provided in the set of the entry's ''operational attributes''.

	An entry can look like this when represented in [[LDAP Data Interchange Format]] (LDIF), a plain text format (as opposed a [[binary protocol]] such as LDAP itself):		An entry can look like this when represented in [[LDAP Data Interchange Format]] (LDIF), a plain text format (as opposed to a [[binary protocol]] such as LDAP itself):
	<syntaxhighlight lang="ldif">		<syntaxhighlight lang="ldif">
	dn: cn=John Doe,dc=example,dc=com		dn: cn=John Doe,dc=example,dc=com

imported>Citation bot: Altered url. URLs might have been anonymized. | Use this bot. Report bugs. | Suggested by Dominic3203 | Category:Internet protocols | #UCB_Category 57/248

2025-06-25T07:21:32Z

Altered url. URLs might have been anonymized. | Use this bot. Report bugs. | Suggested by Dominic3203 | Category:Internet protocols | #UCB_Category 57/248

← Previous revision		Revision as of 07:21, 25 June 2025
Line 107:		Line 107:
	wide range of mechanisms, e.g. [[Kerberos (protocol)\|Kerberos]] or the [[client certificate]] sent with TLS.<ref>[https://www.iana.org/assignments/sasl-mechanisms/sasl-mechanisms.xml SASL Mechanisms at IANA]</ref>		wide range of mechanisms, e.g. [[Kerberos (protocol)\|Kerberos]] or the [[client certificate]] sent with TLS.<ref>[https://www.iana.org/assignments/sasl-mechanisms/sasl-mechanisms.xml SASL Mechanisms at IANA]</ref>

	BIND also sets the LDAP protocol version by sending a version number ~~in the form of~~ an integer. If the client requests a version that the server does not support, the server must set the result code in the BIND response to the code for a protocol error. Normally clients should use LDAPv3, which is the		BIND also sets the LDAP protocol version by sending a version number as an integer. If the client requests a version that the server does not support, the server must set the result code in the BIND response to the code for a protocol error. Normally clients should use LDAPv3, which is the
	default in the protocol but not always in LDAP libraries.		default in the protocol but not always in LDAP libraries.

	BIND had to be the first operation in a session in LDAPv2, but is not required as of LDAPv3. In LDAPv3, each		BIND had to be the first operation in a session in LDAPv2, but is not required as of LDAPv3. In LDAPv3, each
	successful BIND request changes the authentication state of the session and each unsuccessful BIND request resets the authentication state		successful BIND request changes the authentication state of the session and each unsuccessful BIND request resets the authentication state of the session.
	of the session.

	===Delete===		===Delete===
Line 176:		Line 175:

	===Extended operations===		===Extended operations===
	The Extended Operation is a generic LDAP operation that can define new operations that were not part of the original protocol specification. StartTLS is one of the most significant extensions. Other examples include Cancel and Password Modify.{{cn\|date=January 2024}}		The Extended Operation is a generic LDAP operation that can define new operations that were not part of the original protocol specification. StartTLS is one of the most significant extensions. Other examples include Cancel and Password Modify.{{citation needed\|date=January 2024}}

	====StartTLS====		====StartTLS====
Line 237:		Line 236:

	Server administrators can add additional schema entries in addition to the provided schema elements. A schema for representing individual people within organizations is termed a [[white pages schema]].		Server administrators can add additional schema entries in addition to the provided schema elements. A schema for representing individual people within organizations is termed a [[white pages schema]].

			==Security vulnerabilities==

			===LDAP injection===

			LDAP injection is a [[cyberattack\|computer security attack]] similar to [[SQL injection]] that can occur when an application implementing LDAP fails to properly sanitize user input.<ref>{{cite web \|url=https://owasp.org/www-community/attacks/LDAP_Injection \|publisher=OWASP Foundation \|website=[[OWASP]] \|title=LDAP Injection Description }}</ref>

			As an example, consider an LDAP search query that allows the user to search people by their name, the <code>cn</code> attribute. A malicious user might replace a valid name with the <code>*</code> character, which matches any object with the <code>cn</code> attribute. If the application is vulnerable to this attack, it may display attributes that the searching user is not authorized to see.<ref>{{cite book \|url=https://books.google.com/books?id=cTI9EQAAQBAJ&dq=ldap+injection&pg=SA10-PA51 \|title=A Beginner's Guide To Web Application Penetration Testing \|first=Ali \|last=Abdollahi \|year=2025 \|isbn=9781394295609 \|publisher=Wiley }}</ref>

			LDAP injection vulnerabilities are mitigated by [[escape sequence\|escaping]] variables. Escaping is accomplished with two distinct encoding functions {{mdash}} one for Distinguished Names and one for search strings {{mdash}} because they each allow different special characters. Some web frameworks come with escaping built in.<ref>{{cite report \|url=https://cheatsheetseries.owasp.org/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.html \|publisher=OWASP Foundation \|title=LDAP Injection Prevention Cheat Sheet }}</ref>

			===Man-in-the-middle attacks===

			Like other parts of TCP/IP, LDAP was originally created without encryption. This makes it vulnerable to [[man-in-the-middle]] attacks, in which attackers intercept credentials during the bind process. This attack can be mitigated by requiring LDAPS or StartLDAP during every bind involving credentials.<ref>{{cite book \|url=https://books.google.com/books?id=j4FiEQAAQBAJ&dq=ldap+man+in+the+middle&pg=PT224 \|title=LDAP Architecture and Implementation: Definitive Reference for Developers and Engineers
			\|first=Richard \|last=Johnson \|year=2025 \|publisher=HiTeX Press }}</ref>

	==Variations==		==Variations==
Line 248:		Line 262:
	As LDAP has gained momentum, vendors have provided it as an access protocol to other services. The implementation then recasts the data to mimic the LDAP/X.500 model, but how closely this model is followed varies. For example, there is software to access [[SQL]] databases through LDAP, even though LDAP does not readily lend itself to this.<ref>[http://www.openldap.org/doc/admin24/backends.html#SQL Openldap.org]</ref> X.500 servers may support LDAP as well.		As LDAP has gained momentum, vendors have provided it as an access protocol to other services. The implementation then recasts the data to mimic the LDAP/X.500 model, but how closely this model is followed varies. For example, there is software to access [[SQL]] databases through LDAP, even though LDAP does not readily lend itself to this.<ref>[http://www.openldap.org/doc/admin24/backends.html#SQL Openldap.org]</ref> X.500 servers may support LDAP as well.

	Similarly, data previously held in other types of data stores are sometimes moved to LDAP directories. For example, Unix user and group information can be stored in LDAP and accessed via [[Pluggable Authentication Modules\|PAM]] and [[Name Service Switch\|NSS]] modules. LDAP is often used by other services for authentication and/or authorization (what actions a given already-authenticated user can do on what service). For example in Active Directory Kerberos is used in the authentication step, while LDAP is used in the authorization step.		Similarly, data previously held in other types of data stores are sometimes moved to LDAP directories. For example, Unix user and group information can be stored in LDAP and accessed via [[Pluggable Authentication Modules\|PAM]] and [[Name Service Switch\|NSS]] modules. LDAP is often used by other services for authentication and/or authorization (what actions a given already-authenticated user can do on what service). For example, in Active Directory Kerberos is used in the authentication step, while LDAP is used in the authorization step.

	An example of such data model is the GLUE Schema,<ref>[https://www.ogf.org/documents/GFD.218.pdf Open Grid Forum : Project Home<!-- Bot generated title -->]</ref> which is used in a distributed information system based on LDAP that enable users, applications and services to discover which services exist in a Grid infrastructure and further information about their structure and state.		An example of such data model is the GLUE Schema,<ref>[https://www.ogf.org/documents/GFD.218.pdf Open Grid Forum : Project Home<!-- Bot generated title -->]</ref> which is used in a distributed information system based on LDAP that enable users, applications and services to discover which services exist in a Grid infrastructure and further information about their structure and state.

imported>Tule-hog: /* Top */ c/e

2025-04-03T18:15:47Z

Top: c/e

Show changes