What is LDAP?

Lightweight Directory Access Protocol (LDAP) is a client-server protocol for reading and searching directory services such as Microsoft Active Directory. It carries queries for usernames, group memberships, and other attributes, letting network devices authenticate users and enforce role- or group-based policy without maintaining their own user database.

Key takeaways

• LDAP queries directory servers such as Active Directory for users and groups.
• A bind operation authenticates the client before any search can run.
• Distinguished names (DNs) address individual entries in the directory tree.
• Versa devices use LDAP server profiles to authenticate users and fetch roles.
• LDAPS and StartTLS encrypt LDAP sessions so credentials aren’t sent in the clear.

On this page: Why it matters · How it works · Types · LDAP & Versa · FAQ

Why is LDAP important?

Almost every enterprise network already has a directory – Active Directory, most commonly – holding every employee’s username, password hash, and group memberships. LDAP matters because it lets network and security devices reuse that directory instead of maintaining a separate, duplicate list of users. A firewall or gateway that speaks LDAP can authenticate someone against the same account they use to log into their laptop, and can apply policy based on the groups that account already belongs to.

That matters operationally as much as securely. Without LDAP, administrators would have to provision and de-provision users on every device individually; with it, adding someone to an Active Directory group is enough to grant or revoke access everywhere that group is referenced in policy. Because LDAP is an open, vendor-neutral standard, it also lets equipment from different vendors query the same directory the same way – which is why it remains the default integration point between network infrastructure and enterprise identity, even as newer protocols like SAML and RADIUS handle other parts of the authentication story.

What is LDAP?

LDAP organizes directory data as a tree of entries, called the Directory Information Tree (DIT). Each entry is addressed by a distinguished name (DN) – a path built from components such as Common Name (CN), Organizational Unit (OU), and Domain Component (DC) – and carries attributes defined by an object class, such as a user’s email address or a group’s member list.

A client interacts with the directory through a small set of operations. Bind authenticates the client, using a service account’s DN and password (the Bind DN and Bind password); only after a successful bind can the client run further operations. Search retrieves entries matching a filter, scoped beneath a starting point called the Base DN – for example, every user whose memberOf attribute lists a given group. LDAP typically runs over TCP port 389, or port 636 when wrapped in TLS from the start.

Types of LDAP

Three bind types authenticate an LDAP client with different strength. Anonymous bind sends no credentials and is disabled on production directories. Simple bind – the mode most network devices use – sends a DN and password in plain text, so it must run over an encrypted session. SASL bind delegates authentication to a mechanism such as Kerberos, proving identity without transmitting the password at all.

Transport security is a separate choice layered on top. Plain LDAP sends everything, including simple-bind credentials, unencrypted. LDAPS wraps the entire session in SSL/TLS from the first packet, on a dedicated port. StartTLS begins as a plain connection on the standard LDAP port and upgrades it to TLS mid-session, avoiding a second listening port. Almost every directory in the field is Microsoft Active Directory, though standards-compliant alternatives such as OpenLDAP and 389 Directory Server implement the same protocol and can serve as an LDAP target in its place.

LDAP has also evolved through protocol versions. LDAPv2, defined in the early 1990s, is obsolete and unsupported by modern directories. LDAPv3, standardized across RFCs 4510–4519, is the current version – adding SASL binds, referrals, and extended operations – and is what every production integration, including Versa’s, targets today.

LDAP & Versa

Versa devices authenticate users against Active Directory through an LDAP server profile, which defines the domain name, Base DN, Bind DN and password, bind and search timeouts, and SSL mode (LDAPS or Start TLS with a CA certificate). If the Director node cannot reach the LDAP server directly, a VOS device can be configured as an appliance proxy to fetch the user and group listing on its behalf.

A separate user/group mapping profile tells the device how to interpret that directory’s schema – its group and user object classes, the group-membership attribute, the username format, and a refresh interval (default 60 seconds) – and Director caches the resulting listing, refreshing it roughly every 60 minutes so policy lookups don’t hit the LDAP server directly. The NGFW-specific configuration flow mirrors this for firewall policy, while organization-level settings let administrators scope LDAP access with custom filters, restricting which Active Directory users or groups can reach a SASE client, multitenant gateway, or remote access VPN. An LDAP profile is one of several methods – alongside SAML, Kerberos, RADIUS, certificate, and local database – an authentication profile can reference for user- and group-based NGFW, SD-WAN, CoS, and UTM policy.

Frequently asked questions

What is the difference between LDAP and Active Directory?

LDAP is the open protocol used to query and authenticate against a directory; Active Directory is Microsoft’s directory service, one of several products that expose data over LDAP. Devices “authenticate via LDAP” against an Active Directory server – the protocol and the product are distinct layers.

What port does LDAP use?

Plain LDAP and StartTLS both use TCP port 389 by default; StartTLS upgrades that same plaintext connection to encryption partway through the session, after the initial handshake. LDAPS, which wraps the entire session in SSL/TLS from the first packet instead of upgrading mid-connection, uses a separate dedicated port, 636.

What is a distinguished name in LDAP?

A distinguished name (DN) is the unique path to an entry in the directory tree, built from components like Common Name, Organizational Unit, and Domain Component read outward to the root – for example, cn=jsmith,ou=Users,dc=versa,dc=com names a specific user entry inside a Users container.

How does LDAP differ from RADIUS?

LDAP is a directory-query protocol built to read and search structured user and group data. RADIUS is an authentication, authorization, and accounting protocol built to grant or deny network access and log the decision. Many deployments use both: RADIUS for access decisions, backed by an LDAP directory lookup.

Is LDAP traffic encrypted?

Not by default. Plain LDAP on port 389 sends simple-bind credentials and search results unencrypted, readable to anyone positioned on the network path. Production deployments should enable LDAPS or StartTLS instead, both of which wrap the session in SSL/TLS so credentials and directory data stay protected in transit.

More on LDAP

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about LDAP, these are worth looking at next.