What is LDAP used for?

Question

I know that LDAP is used to provide some information and to help facilitate authorization.

But what are the other usages of LDAP?

Globuliferous

Answer 1

I will focus on why using LDAP, not what is LDAP.

The use model is similar like how people use library cards or phonebooks. When you have a task that requires “write/update once, read/query many times”, you might consider using LDAP. LDAP is designed to provide extremely fast read/query performance for a large scale of dataset. Typically you want to store only a small piece of information for each entry. The add/delete/update performance is relatively slower compared with read/query because the assumption is that you don’t do “update” that often.

Imagine you have a website that has a million registered users with thousands of page requests per second. Without LDAP, every time users click a page, even for static page viewing, you will probably need to interact with your database to validate the user ID and its digital signature for this login session. Obviously, the query to your database for user-validation will become your bottleneck. By using LDAP, you can easily offload the user validation and gain significant performance improvement. Essentially, in this example, LDAP is another optimization layer outside your database to enhance performance, not replacing any database functions.

LDAP is not just for user validation, any task that has the following properties might be a good use case for LDAP:

1. You need to locate ONE piece of data many times and you want it fast

2. You don’t care about the logic and relations between different data

3. You don’t update, add, or delete the data very often

4. The size of each data entry is small

5. You don’t mind having all these small pieces of data at a centralized place

Misfile

Very good description! You answered the very question I keep asking myself each time I read LDAP : Why? Thanks! – Collimate

is LDAP suitable for internet applications? in the sense NON enterprise internal applications? – Christeenchristel

are there any alternatives for ldap? – Creative

What do you mean by saying "By using LDAP, you can offload the user validation.."? With LDAP you post a query to an LDAP server which (probably) uses a databases: isn't it the same bottleneck? – Nickolenicks

@Misfile Very nice description! Just loved it. Instead of giving a textbook answer you have just explained how it is used in real time.Thank you! – Berlyn

Answer 2

That's a rather large question.

LDAP is a protocol for accessing a directory. A directory contains objects; generally those related to users, groups, computers, printers and so on; company structure information (although frankly you can extend it and store anything in there).

LDAP gives you query methods to add, update and remove objects within a directory (and a bunch more, but those are the central ones).

What LDAP does not do is provide a database; a database provides LDAP access to itself, not the other way around. It is much more than signup.

Sergo

Answer 3

Well, there are LDAP servers and the LDAP protocol. Combined, it's a data store, or a database. It's not relational, but it's just a place to store data, and it's optimized to be efficient at reads more than writes. It doesn't support transactions.

Now, it happens to be very popular for storing credentials, but that's by no means its only purpose, and not its original purpose.

Unicycle

Can you clarify what could be the other purposes? – Thrombocyte

Answer 4

Originally posted on openldap.org by OpenLDAP Foundation:

LDAP stands for Lightweight Directory Access Protocol. As the name suggests, it is a lightweight protocol for accessing directory services, specifically X.500-based directory services. LDAP runs over TCP/IP or other connection oriented transfer services. The nitty-gritty details of LDAP are defined in RFC2251 "The Lightweight Directory Access Protocol (v3)" and other documents comprising the technical specification RFC3377. This section gives an overview of LDAP from a user's perspective.

What kind of information can be stored in the directory? The LDAP information model is based on entries. An entry is a collection of attributes that has a globally-unique Distinguished Name (DN). The DN is used to refer to the entry unambiguously. Each of the entry's attributes has a type and one or more values. The types are typically mnemonic strings, like cn for common name, or mail for email address. The syntax of values depend on the attribute type. For example, a cn attribute might contain the value Babs Jensen. A mail attribute might contain the value [email protected]. A jpegPhoto attribute would contain a photograph in the JPEG (binary) format.

How is the information arranged? In LDAP, directory entries are arranged in a hierarchical tree-like structure.

Telekinesis

Answer 5

LDAP is the Lightweight Directory Access Protocol. Basically, it's a protocol used to access data from a database (or other source) and it's mostly suited for large numbers of queries and minimal updates (the sort of thing you would use for login information for example).

LDAP doesn't itself provide a database, just a means to query data in the database.

Converter

Answer 6

The main idea of LDAP is to keep in one place all the information of a user (contact details, login, password, permissions), so that it is easier to maintain by network administrators. For example you can:

• use the same login/passwd to login on an Intranet and on your local computer.
• give specific permissions to a group of user. For example some could access some specific page of your Intranet, or some specific directories on a shared drive.
• get all the contact details of the people in a company on Outlook for example.

Victimize

No no no. That's the function of a directory, not of LDAP. That's like saying the function of SQL is to provide a database; it isn't; directories provide LDAP access, not the other way around. – Sergo

I have to agree, this is mistaking the data store for the access protocol. – Quiescent

@Sergo Mainly this answer is very useful and concise, but it is for LDAP Server as I gathered from info all around. – Shiksa

Guys, you are arguing that miso-soup is not a soup. Technically it is correct. But for practical reasons the answer is very good, because it simply explains WHY and WHERE that "obscure LDAP thing" is used, putting aside the technical explanation. Most people in that world have no idea what "Directory" is, or how DB works. So simply, running LDAP on server allows storing all the network credentials and serving all the domain users in one place. Yes, there are dependencies to DBs, tricky wrappers for serving unix and windows credentials at the same server, but it tells nothing to simple user. – Wsan

Answer 7

The main benefit of using LDAP is that information for an entire organization can be consolidated into a central repository. For example, rather than managing user lists for each group within an organization, LDAP can be used as a central directory accessible from anywhere on the network. And because LDAP supports Secure Sockets Layer (SSL) and Transport Layer Security (TLS), sensitive data can be protected from prying eyes.

LDAP also supports a number of back-end databases in which to store directories. This allows administrators the flexibility to deploy the database best suited for the type of information the server is to disseminate. Because LDAP also has a well-defined client Application Programming Interface (API), the number of LDAP-enabled applications are numerous and increasing in quantity and quality.

Feverfew

Answer 8

I have had the opportunity to start a project for school about ldap, from scratch, but before getting to know what is ldap, I had to understand what is a directory, there are many (most used directories are novell and windows), here you can see what the directory in Wikipedia.

And ldap is the protocol to communicate with the board, one of the best books I've found is this one.

Franck

Answer 9

• LDAP main usage is to provider faster retrieval of data . It acts as a central repository for storing user details that can be accessed by various application at same time .

• The data that is read various time but we rarely update the data then LDAP is better option as it is faster to read in it because of its structure but updating(add/updatee or delete) is bit tedious job in case of LDAP

• Security provided by LDAP : LDAP can work with SSL & TLS and thus can be used for sensitive information .

• LDAP also can work with number of database providing greater flexibility to choose database best suited for our environment

• Can be a better option for synchronising information between master and its replicase
• LDAP apart from supporting the data recovery capability .Also , allows us to export data into LDIF file that can be read by various software available in the market

Kurtkurth

Answer 10

LDAP is just a protocol to access structured information. LDAP has standardized local and remote access to information whereas in case of database there is only standardized local access and remote access is proprietary.

LDAP server is optimized for search operation and database for transactions(Insert/Delete).

For more information refer following link:

http://www.itszero.in/2013/09/what-is-ldap-ad-adam.html

Griffis

Answer 11

In Windows Server LDAP is a protocol which is used for access Active Directory object, user authentication, authorization.

Sinister

Answer 12

To take the definitions the other mentioned earlier a bit further, how about this perspective...

LDAP is Lightweight Directory Access Protocol. DAP, is an X.500 notion, and in X.500 is VERY heavy weight! (It sort of requires a full 7 layer ISO network stack, which basically only IBM's SNA protocol ever realistically implemented).

There are many other approaches to DAP. Novell has one called NDAP (NCP Novell Core Protocols are the transport, and NDAP is how it reads the directory).

LDAP is just a very lightweight DAP, as the name suggests.

Quiescent

Answer 13

Well, LDAP is a protocol(way) to access structured info. LDAP uses client-server model so, LDAP client makes request to access required info. LDAP server stores info not in relational way but in attribute and value pair. You can use LDAP to assign same privilege to group of user or same credential to access multiple services. For more details refer following link : http://www.zytrax.com/books/ldap/ch2/

Griffis

Answer 14

LDAP stands for Lightweight Directory Access Protocol.It is used in Active Directory for communicating user queries..e.g.. LDAP can be used by users to search and locate a particular object like a laser printer in a domain.

Dianoia

Answer 15

LDAP is also used to store your credentials in a network security system and retrieve it with your password and decrypted key giving you access to the services.

Pileous

Answer 16

Light weight directory access protocal is used to authenticate users to access AD information

Valrievalry

Answer 17

LDAP stands for Lightweight Directory Access Protocol (not a database). As the name says it is used for accessing/reading data. LDAP is a protocol to access data from directory servers which is a hierarchical database, it is designed for reading, browsing, searching, and organizing data. This kind of data we do not modify regularly or it is very infrequently modified data.

Big companies store their internal data, for example, user names with their title and id or phonebooks of their workers on LDAP servers (this server implements a tree-structured database). Those data can be reached by the workers of that company through the LDAP protocol. LDAP protocol runs over TCP or UDP protocol and accesses the server through port 389. There is also LDAPS that runs over SSL and accesses the server through port 636.

Teetotal

Answer 18

In simple language, LDAP is used to access the directory services like active directory. It is the protocol to access directory services.

Cormier