--- title: "Lightweight Directory Access Protocol — Identity Glossary…" description: "LDAP is the open, decades-old protocol for querying and modifying directory services — used most famously by Microsoft Active Directory and OpenLDAP — and…" lang: en json-ld: | [ { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://idsync.com/" }, { "@type": "ListItem", "position": 2, "name": "Glossary", "item": "https://idsync.com/glossary" }, { "@type": "ListItem", "position": 3, "name": "Lightweight Directory Access Protocol", "item": "https://idsync.com/glossary/ldap" } ] }, { "@context": "https://schema.org", "@type": "DefinedTerm", "@id": "https://idsync.com/glossary/ldap", "name": "Lightweight Directory Access Protocol", "alternateName": [ "LDAP", "LDAP" ], "description": "LDAP is the open, decades-old protocol for querying and modifying directory services — used most famously by Microsoft Active Directory and OpenLDAP — and still the backbone of authentication for Linux servers, network gear, legacy apps, and on-prem infrastructure.", "url": "https://idsync.com/glossary/ldap", "inDefinedTermSet": "https://idsync.com/glossary" } ] --- [![IDSync — identity software buyer platform](/assets/idsync-logo-BKS89EW4.png)](/) [Directory](/directory) [Compare](/compare) [Resources](/resources) [Browse tools](/directory)[Run Stack Finder](/stack-finder) 1. [Home](/) 2. [Glossary](/glossary) 3. Lightweight Directory Access Protocol Architecture # Lightweight Directory Access Protocol (LDAP) LDAP is the open, decades-old protocol for querying and modifying directory services — used most famously by Microsoft Active Directory and OpenLDAP — and still the backbone of authentication for Linux servers, network gear, legacy apps, and on-prem infrastructure. Last reviewed 3 months ago Key points - LDAP defines a tree-structured directory (DN, OU, CN) and operations: bind, search, add, modify, delete. - Most enterprise environments still authenticate against LDAP/AD for switches, jump hosts, legacy apps, and Linux PAM. - Modern IdPs (Okta, Entra ID, JumpCloud) act as LDAP servers for legacy apps that can't speak SAML/OIDC. - LDAP bind = authentication; LDAP search = directory query. Don't use plain LDAP without LDAPS / StartTLS. - Active Directory is LDAP + Kerberos + DNS + a ton of Microsoft-specific extensions. ## What is LDAP? The **Lightweight Directory Access Protocol (LDAP)** is the standard protocol for talking to a directory service — a database optimized for read-heavy, hierarchical lookups of people, groups, devices, and configuration. It's been the lingua franca of enterprise identity since the 1990s and isn't going anywhere. ## What LDAP looks like A directory is a tree. Each entry has a **Distinguished Name (DN)** like: \`\` `cn=alice,ou=engineering,dc=acme,dc=com` \`\` Operations: - **Bind** — authenticate a client (often with a password). - **Search** — query with filters like `(&(objectClass=user)(memberOf=cn=admins,...))`. - **Add / Modify / Delete** — manage entries. ## Where it still lives - **Active Directory** — Microsoft's directory, accessed over LDAP/LDAPS, layered with Kerberos for SSO. - **OpenLDAP, 389 Directory, FreeIPA** — open-source AD alternatives. - **Linux PAM** — `nss-pam-ldapd` so server logins authenticate against AD. - **Network gear** — switches, firewalls, VPN concentrators all support LDAP auth. - **Legacy apps** — anything older than ~2010 that doesn't speak SAML/OIDC usually speaks LDAP. ## LDAP today Modern cloud IdPs offer **LDAP interfaces** (Okta LDAP Interface, JumpCloud LDAP-as-a-Service, Entra Domain Services) precisely so legacy apps can keep working while user lifecycle moves to the cloud. ## Security must-haves - **LDAPS or StartTLS** — never plain LDAP for binds. Microsoft is gradually enforcing LDAP signing and channel binding. - **Service accounts with read-only scope** — apps that query LDAP shouldn't have write. - **No anonymous binds** for sensitive trees. - **Monitor LDAP queries** — recon tools (BloodHound) abuse LDAP read access; ITDR/AD tools detect anomalous patterns. ## Editorial note If you're cloud-only and greenfield, you probably don't need LDAP — modern apps speak SAML/OIDC. If you have _any_ on-prem infrastructure (switches, jump hosts, legacy apps), LDAP is unavoidable, and the question is whether to keep AD or replace it with a cloud LDAP interface. ## Standards & references - [RFC 4511 — LDAP](https://datatracker.ietf.org/doc/html/rfc4511) IDSync provides educational buyer guidance based on publicly available information, editorial review, and user-submitted data. Vendor information should be verified before purchase. [Who we are, our methodology & disclosure policy](/about). ### One identity concept, explained per issue Get vendor-neutral identity explainers and market updates in your inbox. Work email\* Name Company Role (optional) Interests (optional) Pick what you want more of. IAMCIAMSSO/MFAIGA/PAMSCIM/provisioningAI agent identityVendor updatesSecurity incidents Subscribe Twice-monthly identity digest. Curated, vendor-neutral. Unsubscribe any time. ### Vendor categories [iam platforms](/directory/category/iam-platforms) ### Related terms [active directory](/glossary/active-directory)[kerberos](/glossary/kerberos)[identity provider](/glossary/identity-provider) ### Not sure which tool you need? Run the IAM Stack Finder for a vendor-neutral shortlist tailored to your stack. [Run the Stack Finder](/stack-finder) ### Explore tools for this topic Browse vetted vendors in the iam platforms category. [Explore tools](/directory/category/iam-platforms) [![IDSync home](/assets/idsync-logo-BKS89EW4.png)](/) The buyer-focused platform for identity, access, and authentication software. #### Platform - [Home](/) - [IAM Stack Finder](/stack-finder) - [Directory](/directory) - [Resources](/resources) - [State of AI Agent Identity 2026](/reports/state-of-ai-agent-identity-2026) - [Buyer Guides](/guides) - [Glossary](/glossary) - [Newsletter](/newsletter) - [Newsletter Archive](/newsletter/archive) #### Best of guides - [All comparisons](/compare) - [All vendor alternatives](/alternatives) - [Best SSO tools](/compare/best-sso-tools) - [Best MFA tools](/compare/best-mfa-tools) - [Best PAM tools](/compare/best-pam-tools) - [Best IGA tools](/compare/best-iga-tools) - [Best CIAM tools](/compare/best-ciam-tools) - [Best passwordless auth](/compare/best-passwordless-authentication-tools) - [Best identity security](/compare/best-identity-security-tools) - [Best machine identity](/compare/best-machine-identity-tools) - [Best SaaS access governance](/compare/best-saas-access-governance-tools) - [Best developer auth](/compare/best-developer-authentication-tools) - [Best for startups](/compare/best-iam-tools-for-startups) - [Best for enterprises](/compare/best-iam-tools-for-enterprises) - [Best SCIM tools](/compare/best-scim-provisioning-tools) - [Best for AI agents](/compare/best-ai-agent-identity-tools) - [Best NHI tools](/compare/best-nhi-management-tools) - [Okta pricing explained](/guides/okta-pricing) - [Auth0 pricing explained](/guides/auth0-pricing) - [Okta alternatives](/alternatives/okta) - [Auth0 alternatives](/alternatives/auth0) #### For Vendors - [Sponsor](/sponsor) - [Badges](/badges) - [Submit Product](/submit-product) - [Claim Profile](/claim-profile) - [Partner](/partner) #### Company - [About & Methodology](/about) - [Contact](/contact) - [Privacy](/privacy) Vendor names, logos, and trademarks are the property of their respective owners. IDSync is an independent buyer resource and does not imply endorsement unless explicitly stated. Logos are displayed for identification purposes only. IDSync (idsync.com) is operated by TetraCore, Bowling Green, Ohio. It is not affiliated with the IDSync® Active Directory synchronizer by Identity Syncronizer — [learn more](/about#idsync-disambiguation). © 2026 IDSync. All rights reserved. Editorial independence. Sponsored placements are clearly disclosed.