The Lightweight Directory Access Protocol (short: LDAP) is an open protocol with which client applications can access and manage information in a directory service. A directory service is a specialised database storing information about users, groups, devices and other network resources – LDAP is to this day the dominant access protocol for it in corporate networks, universities and public authorities.
How does LDAP work?
LDAP is based on a hierarchical data model: objects are organised in a tree structure, the so-called directory information tree (DIT). Every object possesses a unique distinguished name (DN) and attributes describing it – a user object, say, username, email address or group memberships. Client applications send operations such as bind (authentication), search (query) or modify (change) to the directory server, reachable via TCP/IP on port 389 (unencrypted) or 636 (LDAPS).
LDAP vs. Active Directory
A common misunderstanding: LDAP and Active Directory are often used interchangeably, but they aren’t the same.
| LDAP | Active Directory | |
|---|---|---|
| What it is | An open protocol | Microsoft's concrete directory service implementation |
| Authentication | Via LDAP bind | Primarily via Kerberos, LDAP as one of several protocols |
| Prevalence | Cross-platform, strong in Linux/Unix environments | Windows server environments |
| Example alternatives | OpenLDAP, 389 Directory Server | – |
Security: LDAP vs. LDAPS
Classic LDAP transmits requests and credentials unencrypted by default, a considerable risk in any network that isn’t fully isolated. LDAPS (LDAP over SSL/TLS) encrypts the entire connection and should be mandatory for any production use, as should the alternative StartTLS, which encrypts an existing plaintext connection after the fact. We’re happy to support you with securing directory services and integrating them into existing systems as part of our cyber security services.
LDAP and single sign-on
A central directory like LDAP is frequently the basis for single sign-on (SSO): users log in once and receive access to several applications, instead of authenticating separately for each one. In modern architectures, LDAP often takes the role of the central directory store while the actual SSO login runs via additional protocols such as SAML or OIDC. For companies with several internal systems, such central user management is a classic use case for custom software development, for example when connecting existing specialist applications to a central directory.
The 2026 trend: cloud identity and passwordless authentication
More and more companies complement classic, on-premise LDAP directories with cloud identity services such as Microsoft Entra ID (formerly Azure AD) or Okta, in practice mostly as a hybrid model: a directory like Active Directory remains on-site for legacy applications, while synchronisation mirrors the identities into the cloud and modern, cloud-based applications are connected via SAML or OIDC. At the same time, passwordless authentication via passkeys (FIDO2/WebAuthn) is increasingly establishing itself as the standard and gradually displacing classic password logins, including in environments that continue to rely on LDAP directories as the data source in the background.
Conclusion
Despite new cloud identity services, LDAP remains the backbone of many corporate directories, especially in grown, heterogeneous IT landscapes with legacy applications. Whether a classic LDAP directory, a hybrid model with cloud connection or a completely new identity solution is the right choice depends on your existing system landscape. We’re happy to advise you on the fitting strategy – as part of our custom software development or in a free first conversation.