The Lightweight Directory Access Protocol (LDAP) is an open standard protocol for querying and modifying directory services that store information about users, groups, computers and other network resources.
How LDAP works
A directory organises entries in a tree, each identified by a distinguished name (DN) such as cn=Alice,ou=Staff,dc=example,dc=com and holding attributes like email address, group membership or password hash. Clients connect to an LDAP server, authenticate (“bind”) and then search, add or modify entries. LDAPv3 is defined in RFC 4511 and related documents. LDAP uses TCP port 389; LDAPS (LDAP over TLS) uses port 636. Microsoft Active Directory, OpenLDAP and many identity platforms expose LDAP, and applications, VPNs and printers often use it to check user credentials.
Why LDAP matters for security
- Cleartext credentials – simple binds over unencrypted LDAP send passwords in plain text. Microsoft has urged administrators to enforce LDAP signing and channel binding on every domain controller.
- Reconnaissance – any authenticated domain user can query AD via LDAP; tools such as BloodHound’s collectors use this to map users, groups and attack paths (MITRE ATT&CK T1087.002).
- LDAP injection (CWE-90) – like other forms of code injection, unsanitised input in search filters can bypass authentication or expose data.
- Log4Shell – the 2021 Log4j flaw (CVE-2021-44228) was typically exploited with JNDI lookups that loaded attacker code from malicious LDAP servers.
- DDoS amplification – exposed connectionless LDAP (CLDAP, UDP 389) is abused in reflection attacks.
Best practices
- Require LDAPS or StartTLS and enforce signing and channel binding.
- Use dedicated service accounts with least privilege for LDAP integrations and prefer Kerberos or modern federation where possible.
- Escape special characters in LDAP filters built from user input.
- Never expose LDAP ports to the internet and monitor for unusual bulk queries.
