Which protocols does LDAP use for the different parts of client-server communication?

Queries and changes travel over the LDAP protocol itself (secured with TLS as LDAPS or StartTLS), and user authentication can be delegated to SASL (Simple Authentication and Security Layer, RFC 4422).

• LDAP (RFC 4511): the application protocol on top of TCP, default port 389, carrying the operations (bind, search, modify, ...).
• LDAP over TLS: encrypts the session so that passwords and directory data cannot be read on the wire. Either the whole connection is TLS from the start (LDAPS, port 636) or a plain connection is upgraded with StartTLS.
• SASL: a framework that plugs authentication mechanisms into LDAP's bind operation, so LDAP can support passwords, Kerberos tickets or client certificates without changing the protocol.

The pattern is a good example of layering: LDAP defines what to ask the directory, TLS protects the channel, and SASL defines how to prove who is asking.

Go deeper:

• RFC 4513: LDAP Authentication Methods and Security Mechanisms — how bind, TLS and SASL work together.
• RFC 4422: SASL — the framework specification LDAP uses for pluggable authentication.