LDAP Explained: From Distinguished Names to User Authentication

It is common for organizations to rely on LDAP (Lightweight Directory Access Protocol) to carry out critical user management, storage, and authentication.

However, it can confuse users, leading them to mix it with Active Directory.

In this article, we’ll look at LDAP, its purpose, and how it works. Then, we’ll review its key features, directory structure, and data organization capabilities. Lastly, we’ll cover LDAP’s importance in managing directory service and user authentication.

What is LDAP?

LDAP stands for Lightweight Directory Access Protocol. It is an open protocol that governs secure user authentication for on-premise directories. Furthermore, it is a vendor-neutral application protocol, making it versatile and ubiquitous, especially in the distributed directory information services over the Internet.

LDAP is efficient in enabling applications to query user information. This means it can work in various ways in IT infrastructure services, including email services, authorization, license management, and user management.

However, it shouldn’t be confused with active directory services- a set of services/databases businesses use to organize, access, and secure IT assets. Basically, directory services enable organizations to store data that is descriptive, static, and valuable.

Technically, LDAP is attributed to the complete process of data representation within a directory service. It ensures that users can get data in a pre-defined manner. This means LDAP enables organizations to create data entries within directory services through its tools.

So, within an Active Directory, LDAP also ensures how entries are composed based on different primitive elements outlined.

In short, LDAP is a:

Communications protocol
It is an open vendor-neutral application protocol
The software protocol stores and arranges data to be easily searchable.
Works with on-premise directories
Works with Active Directory that contains data that is static, descriptive, and valuable
It is not a new protocol and was released in 2003

What is its purpose?

LDAP’s purpose revolves around two things:

It stores data in an LDAP/Active directory
Authenticate the user’s access to that said directory
Enable applications to use proper communication language for sending and receiving data from directory services.

In other words, it acts as a communications protocol that is not only capable of authentication and authorization but also organizes data in a searchable way. Using LDAP, organizations can store critical user and IT asset information, including user credentials. Moreover, it can ensure secure access by enabling administrators to set access rules actively.

How LDAP works?

At the core of LDAP, client-server architecture is at play.

So, when LDAP authentication takes place, it follows a client-server model. And during this, the key players include the following:

Directory System Agent (DSA): A server running LDAP on a specific network.
The distinguished name (DN) contains the path for navigating the directory information tree (DIT).
Directory User Agent (DUA): The DUA is used to access DSAs as a client.
Relative Distinguished Name (RDN): The RDN specifies each component in the DN’s path.
Application Programming Interface (API): We have APIs that communicate between the services and products.

In the LDAP authentication process, when a user starts an LDAP-client program such as an email application Administrator can configure how the LDAP client interacts with the directory services for authentication. For example, it can use any of the two available user authentication methods:

SASL authentication with Kerberos
Simple SSO authentication with login credentials

In the login attempt, DN authentication is requested. Once the process starts, LDAP assigns the client to the Directory System Agent (DSA), which uses the DN to search for matching records in the database.

The Relative Distinguished Name (RDN) within the DN is a critical part of the LDAP search as it is used in every step of the searching process through the Directory Information Tree (DIT).

If the search is successful, the matching UID and user Password are matched to validate the user. If not, it returns invalid results.

Finally, the client unbinds from the LDAP server. With it done, the authenticated user can then communicate with the services through the APIs. This means he can go through all the stored information — the only limitation is granted permissions.

If you want to read more about how LDAP works, check out its paper published in 2003 by Greg Vaneder and Mark Wahl. And, if you want to read more about how LDAP search operations, check out The LDAP Search Operation.

Key Features of LDAP

The LDAP key features can be summarized below:

Authenticate user sessions: It can be used to authenticate user sessions to a database service such as Active Directory.
Different operation types: It can also do operations to a directory server database, including
- binding sessions
- deleting LDAP entries
- Modify existing entries
- Search and compare entries.
- Abandon requests
- Unbind operations
Lightweight: LDAP is lightweight, ensuring a small overhead to the network and system resources.
Vendor and protocol independent: LDAP is also vendor and protocol independent. This means it works with any vendor/solution/protocol. For example, you can use LDAP over TCP/IP or X.25. However, the latest LDAP version, LDAPv3, uses TCP/IP.
Directory structure: LDAP uses a directory-tree structure to store and access assets within a directory database. The parent-child relationship means faster search and retrieval.
Standardization: LDAP is standardized by the IETF (Internet Engineering Task Force). The standardization ensures that LDAP works across different vendors.
Security: LDAP is secure. It achieves security by using secure TLS over the TCP/IP layer. It can also use Secure Socket (SSL) to encrypt, decrypt, and transfer information remotely with complete integrity and confidentiality.
Replication: LDAP also supports replication across multiple servers. It ensures data redundancy and provides data availability in case of any faults. It uses Syncrepl – a Sync replication engine.

LDAP Directory Structure

The LDAP Directory has a clean, defined structure to it. This enables easy access to data and adds to the searchability of the LDAP directory content.

As LDAP follows a tree-like structure, it is hierarchical. And that’s why it is mainly preferred as Directory Information Tree (DIT).

The different levels of LDAP directory structure include:

Root directory
- Countries
Organization
- Organizational Unit
  - Individuals

As you can see that there is a tree structure in the LDAP directory. The “root” directory is a top-level entry that includes all other entries in the directory level. Under it, you get Country (countries) which then branches out to Organization (s).

Next, it branches out to Organizational Units (OU) and, finally, Individuals and Groups.

To understand the LDAP directory structure, let’s take a look at an example below.

 - Root (Top-level entry)
   |
   +-- Country: "dc=com" (e.g., dc=example,dc=com)
         |
         +-- Organization: "dc=example" (e.g., dc=example)
               |
               +-- Organizational Unit (OU): "ou=Users"
               |      |
               |      +-- User: "cn=Nitish Singh"
               |      |
               |      +-- User: "cn= Oliver Green"
               |
               +-- Organizational Unit (OU): "ou=Groups"
                      |
                      +-- Group: "cn=Admins"
                      |
                      +-- Group: "cn=Users"
		|
		+-- Group: “cn=Superusers”

The Root entity is identified with DC, which stands for Domain Component attribute. So, if “dc=com,” the root entry is identified as the “com” domain.

Under root, you can have multiple organizations or domains. It is represented by “dc=organization.” under the “com” domain.

Similarly, each organization can have one or multiple Organizational Units (OU). The administrator can organize them logically into subdivisions. For example, you can set OU to “users,” “groups‘ or “superusers.”

Finally, under each OU, you can list different entries, including groups, devices, users, etc. In our example, two values of OU users include “Nitish Singh” and “Oliver Green.” Likewise, under OU Groups, we have “Admins,” “Users,” and “Superusers.”

The LDA directory structure depends heavily on Distinguished Name(DN) as it is used to identify each entry. That’s because it contains a unique name and is used to retrieve the Relative Distinguished Name (RDN).

LDAP Common Elements

To understand the LDAP data organization, we’ll need to understand LDAP’s common elements, which lead to the LDAP system’s entries construction.

The basic LDAP data components include:

Attributes:
Entries:
Data Information Trees

Attributes

Attributes in LDAP are key-value pairs. These store data within the LDAP system. For example, the attribute mail must be used to store mail within the LDAP system.

mail: nitish@geekflare.com

Entries

The entries within the LDAP system associate themselves with attributing to provide meaning. You can think of entries as a collection of related attributes.

For example, the data in the LDIF (LDAP Data Interchange Format) format will look as below:

dn: sn=Hogwarts, ou=wizards, dc=WizardingWorld, dc=fiction

objectclass: wizard

sn: Hogwarts

cn: Harry Potter

Data Information Trees

Data Information Trees, or DITs, represent and access data within an LDAP system. As most data is branched, it makes sense to represent them through trees. It is analogous to a file system with a parent-children association.

LDAP Data Organization

Now with the basic idea of entities, we can explore data organization within the LDAP system.

Here, LDAP utilizes the DIT to organize and structure the data. However, how does it achieve it? Let’s discuss it below.

To place entries in a DIT that are related to each other hierarchically. So, when a new entry is created, it is added to the tree-like structure as a child of an existing entry.

It all starts at the top of the hierarchy tree in the DIT. As it covers all the child entries, it is mainly labeled as an organization such as “dc=com or example. This is done using domain components to ensure easy management.

This way, the administrator can set the location using l=location_name or organizational segments, such as ou=tech, marketing, etc.

The entries use Organization Unit (OU) objectClass. That’s because entries can use the attribute label ou=. They’re simple and offer an excellent way to categorize and find information within the DIT.

Next comes another important concept known as Relative Distinguished Name. It is the relative name of an element depending on its DIT hierarchy level. So, to access an entry, you need to enter the RDN values of the entity along with the parent’s RDN value.

This creates a chain of RDN values, which goes from the bottom to the top, creating a path to that entry. And this chain of RDN values is known as “Distinguished Name or DN.”

In other words, you must mention the DN during entry creation so that LDAP knows precisely where you need to place the new asset or information. So, RDN acts as a relative value, whereas DN is more of an absolute path.

Importance of LDAP

In this section, we’ll take a look at the importance of LDAP from two perspectives:

Managing Directory Service: LDAP protocol has the proper means to store and access LDAP directory data. LDAP is a means to manage, store, access, and secure data. It also ensures efficient information retrieval. Moreover, it offers scalability and replication as well.
User Authentication: Besides managing directory services, LDAP excels at user authentication and authorization. Once the connection is created, the user can access stored assets based on the access rules set by the administrator.

LDAP vs. Active Directory

It is common for people to confuse LDAP and Active Directory. LDAP and Microsoft’s Active Directory work closely to provide organizations with a means to safely and securely store and access organizational data across departments safely and securely.

So, LDAP is protocol, whereas Active Directory is a directory service product that stores the organizational data in a tree-like structure.

LDAP acts as a communication protocol to access the directory servers such as Active Directory.

Conclusion

LDAP is a key protocol for working with active directory services. It is a lightweight protocol that doesn’t create any overhead on the services and servers it works with. Moreover, its open-source, vendor-neutral, and standardized nature means it can easily be integrated into existing solutions.

You may also explore Multi-Factor Authentication (MFA).