The Lightweight Directory Access Protocol (LDAP) is an open, standard protocol for accessing and managing directory information over a network. A directory is a structured database of users, groups, devices and their attributes. Active Directory supports LDAP, and so do many other directory services.

What is LDAP used for?

• Authenticating users for applications that rely on a central directory.
• Looking up people, groups and contact details.
• Checking group membership to decide what someone can access.
• Integrating applications with single sign-on.

How does LDAP work?

A client connects to a directory server and authenticates, which is called a bind. It then sends a search request that specifies where to look, which filter to apply and which attributes to return. The server replies with the matching entries. LDAP can also be used to add, change and delete entries.

What is a distinguished name?

Every entry in a directory has a distinguished name, or DN, that gives its position in the tree, for example cn=Ada Rossi, ou=Finance, dc=example, dc=com. Searches start from a base DN and look below it.

What is the difference between LDAP and Active Directory?

LDAP is a protocol, a way of talking to a directory. Active Directory is a directory service that supports LDAP, along with Kerberos and other mechanisms. An application can use LDAP to query Active Directory, but LDAP is not specific to it.

What is LDAPS?

LDAP over TLS, which encrypts the connection. Standard LDAP usually runs on port 389 and, unless it is protected, sends information in clear text. LDAPS, usually on port 636, or StartTLS protects the exchange.

Why is LDAP a security concern?

Any authenticated user can usually read a large part of the directory. Attackers use that to find users, groups, privileged accounts, computers and service accounts, and to plan their next move. Weak configurations make it worse: simple binds over clear text expose credentials, and anonymous access reveals the directory without any login.

What is LDAP enumeration?

The systematic querying of a directory to map an environment. An attacker with a foothold lists accounts, finds members of privileged groups, looks for service accounts and identifies paths to valuable systems. It is the discovery step that precedes lateral movement and privilege escalation.

What are the warning signs of LDAP abuse?

• Large volumes of queries from one account or host.
• Queries for privileged groups or service accounts.
• Queries from machines that do not normally query the directory.
• Accounts that have never queried the directory beginning to do so.
• Queries that return unusually many attributes.

What is a bind account?

A bind account is the service account an application uses to connect to the directory. They often have more access than needed and passwords that never change, which makes them valuable to attackers who find them in configuration files.

What is LDAP signing?

A setting that requires LDAP messages to be signed, so that tampering and relaying can be detected. Together with encryption, it is one of the standard ways to harden a directory.

What is LDAP injection?

An attack on applications that build search filters from user input without checking it. A crafted input can change the filter and return or alter data that should not be visible. Validating and escaping input prevents it.

Is LDAP still used?

Yes. It remains widely used by older and modern applications alike, which is why directory queries are worth monitoring as a source of signals about reconnaissance.

How do you secure LDAP?

Require signing and encryption, disable anonymous access and clear-text binds, restrict who can read sensitive attributes, give the accounts that applications use to bind only the access they need and monitor query patterns.

Sharelock monitors identity and directory activity, so unusual queries by a valid account, such as a sudden survey of privileged groups, stand out against its normal behaviour.