Quiz Entry - updated: 2026.10.22
Which authentication methods does the LDAP bind operation offer, and what does a bind request contain?
Three methods: no authentication (anonymous), simple authentication (the account's DN plus a password sent unprotected) and SASL authentication (pluggable mechanisms such as Kerberos or certificates); the request carries the protocol version, the DN of the account and the credentials.
| Method | How the client proves its identity | Remark |
|---|---|---|
| Anonymous | Nothing: empty name and password | Read access as configured for anonymous users |
| Simple | DN of the entry + password | The password travels without any obfuscation, so use TLS |
| SASL | A SASL mechanism: password-based, Kerberos (GSSAPI), client certificate (EXTERNAL), ... | Adds methods without changing LDAP |
A bind request has three elements:
BindRequest {
version: 3
name: "cn=Max Mustermann,ou=Benutzer,dc=example,dc=com"
authentication: simple credentials: "GeheimesPasswort123"
}
The same simple bind from the command line, which then asks the server "who am I now?":
ldapwhoami -x -D "cn=Max Mustermann,ou=Benutzer,dc=example,dc=com" -w GeheimesPasswort123 -H ldap://ldap.example.com
Note that this example uses ldap:// without TLS: the password crosses the network in plain text, and -w also leaves it in the shell history. -W (prompt) and ldaps:// or StartTLS (-ZZ) avoid both problems.
Go deeper:
LDAP.com: The LDAP bind operation — simple and SASL binds, anonymous binds and the bind result.- RFC 4511, Section 4.2: Bind Operation — the exact structure of the bind request.