Skip to content

LDAP

The protocol applications use to query a directory such as Active Directory for users, groups, and attributes.

Printers, VPN appliances, and line-of-business applications commonly authenticate against a directory over LDAP. It works well and is deeply embedded in enterprise software.

Plain LDAP sends credentials without encryption, so LDAPS or StartTLS is required for anything carrying authentication, with LDAP signing and channel binding enforced on top of it. Channel binding hardens an already-encrypted session rather than replacing the need for one. The service accounts these integrations use are also a frequent source of over-privilege.

Where this comes up

LDAP sits inside our identity and access work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.

Want this explained against your own setup?

Definitions only get you so far. Book a short call and we will tell you whether this actually matters for your business, and what we would do about it.

Call (855) 737-9500 / (480) 573-3349

Email [email protected]

15-minute response on critical issues, 24/7. Onboarding in two to three weeks.

We reply within one business day. No spam, no pressure.