What is LDAP, and what is it used for in identity and access management?

LDAP (Lightweight Directory Access Protocol) is a client-server network protocol for querying and modifying distributed directory services; applications use it to look up objects and to authenticate and authorise users against a central directory.

LDAP is the language spoken between an LDAP client (an application, a mail client, a login service, a command-line tool) and a directory server (Directory System Agent). The client opens a TCP connection, sends requests such as "authenticate me as this account" or "find all entries whose surname is Meier", and the server answers.

In IAM it does two jobs at once:

• Lookup: read object data such as personal details, group memberships or computer configurations.
• Authentication and authorisation: an application can let the directory check a user's password and then read the user's groups to decide what they may do.

The current version is LDAPv3. Its technical specification is a family of RFCs: RFC 4510 is the road map, RFC 4511 defines the protocol itself, and RFC 4512 to 4519 cover the data model, authentication, DN and filter strings, URLs, syntaxes and the standard user schema. Further RFCs up to RFC 4532 (the "Who am I?" operation) add extensions.

Go deeper:

• RFC 4510: LDAP Technical Specification Road Map — the short index of which RFC defines which part of LDAPv3.
• Lightweight Directory Access Protocol (Wikipedia) — protocol overview, operations, URI scheme and history in one place.