An Application Layer Protocol used for querying and modifying directory services like Active Directory (AD).
It operates over TCP and IP usually over port 389. LDAP over SSL (LDAPS) use Port 636.
It is based on the Client-Server Architecture.
LDAP Authentication in Active Directory (AD)
LDAP is set up to authenticate credentials against AD using a “BIND” operation to set the authentication state for an LDAP session.
There are two types of LDAP authentication.
Simple Authentication
Authentication where a username and password create a BIND request to authenticate to the LDAP server.
This type includes anonymous authentication, unauthenticated authentication, and username/password authentication.
Simple Authentication and Security Layer (SASL) Authentication
Authenticating by using other authentication services, like Kerberos, to bind to the LDAP server and then use the authentication service for LDAP authentication.
The LDAP server uses the LDAP protocol to send an LDAP message to the authentication service, which initiates a series of challenge/response messages resulting in either successful or unsuccessful authentication.
Security Concerns
LDAP authentication messages are sent in cleartext by default so anyone can sniff out LDAP messages on the internal network. It is recommended to use TLS encryption or similar to safeguard this information in transit.