LDAP

LDAP, or Lightweight Directory Access Protocol, is an application protocol used to access and manage distributed directory services over an IP network. Directory services provide a centralized repository of information about users, groups, devices, and other resources, organized in a hierarchical structure called the directory information tree (DIT). Each entry has a Distinguished Name (DN) that uniquely identifies it, and a set of attributes defined by its objectClasses. Common attributes include cn, sn, mail, and uid, while objectClasses specify permitted attributes and inheritance rules.

The directory stores data according to a schema that governs allowed attribute types and the relationships between entries. LDAP supports standard operations such as bind (authentication), search, compare, add, delete, modify, and modifyDN (rename or move). Clients can perform searches using filters, e.g., (uid=jdoe). An LDAP server may refer clients to other servers for data not stored locally, or participate in replication to distribute data and improve fault tolerance. Security can be provided through TLS (StartTLS on port 389 or LDAPS on port 636) and SASL-based authentication. Passwords may be stored in various secure formats, and access control lists regulate read and write permissions.

LDAP is widely used for centralized authentication and authorization, address books, and as the backing store for identity management and provisioning systems. It underpins many single sign-on infrastructures and organizational directory services. Implementations include Microsoft Active Directory (which provides LDAP compatibility with extensions), OpenLDAP, 389 Directory Server, Red Hat Directory Server, and Apache Directory. LDAPv3 is the current standard (RFC 4510 and successors); LDAPv2 is obsolete. It emphasizes fast reads and flexible queries rather than relational data modeling.