LDAP
LDAP stands for Lightweight Directory Access Protocol. It is an open, vendor-neutral application protocol used for accessing and maintaining distributed directory information services over an IP network.
Network administrators use it to manage user authentication and authorization across different systems. It operates via a client-server model. A client connects to an LDAP server, typically on port 389 for standard connections or port 636 for secure connections (LDAPS). The client sends operation requests, such as bind (authenticate), search, or modify. The server processes the request and returns the outcome.
The data within an LDAP system is organized in a hierarchical structure called the Directory Information Tree (DIT). Each entry in the tree consists of a set of attributes, and each attribute has a name and one or more values.
A frequent point of operational confusion is the distinction between LDAP and Active Directory (AD). The following table compares the two entities.
| Feature | LDAP | Active Directory (AD) |
|---|---|---|
| Classification | Protocol | Directory Service Product |
| Developer | Tim Howes, Steve Kille, Wengyik Yeong (Standardized via IETF) | Microsoft |
| Primary Function | Defines the language and rules used to extract and edit data in a directory. | Provides centralized network management; uses LDAP as its core protocol to communicate. |
| Platform Dependency | Platform agnostic; functions across Linux, Unix, macOS, and Windows. | Primarily designed for and integrated with Windows environments. |
| Scope | Limited to reading, writing, and authenticating directory data. | Includes LDAP functionality but adds Group Policy, DNS, and Kerberos authentication. |
Sources:
- Internet Engineering Task Force (IETF). “RFC 4511: Lightweight Directory Access Protocol (LDAP): The Protocol.” ietf.org.
- Microsoft Learn. “Active Directory Domain Services Overview.” learn.microsoft.com.
- Red Hat. “What is LDAP?” redhat.com.
Entities
- LDAP
- Active Directory
- Directory Information Tree
- IETF
- Microsoft
- Tim Howes
- Steve Kille
- Wengyik Yeong
- Kerberos
- DNS
추가 기록 (2026-08-05T14:21:33Z)
추가 정보
고유 이름(DN, Distinguished Name)
DIT 내에서 각 엔트리를 고유하게 식별하는 절대 경로이다.
LDAP 작업(Operations)
클라이언트는 서버에 연결하여 다음과 같은 작업을 수행한다:
- Bind: 인증
- Search: 검색
- Add: 추가
- Modify: 수정
- Delete: 삭제
주요 사용 목적
LDAP는 주로 엔터프라이즈 환경에서 사용자, 그룹, 시스템, 서비스 등의 정보를 중앙 집중화하여 저장하고, 다양한 애플리케이션 및 네트워크 서비스에 대한 단일 로그인(SSO) 및 중앙 인증(Authentication)을 제공하기 위해 사용된다.
LDAP와 Active Directory 비교 (추가 행)
기존 비교 표에 다음 행을 추가합니다.
| 특징 | LDAP | Active Directory (AD) |
|---|---|---|
| 인증 프로토콜 | 단순 바인드 및 SASL (Simple Authentication and Security Layer) | 기본 인증으로 Kerberos를 사용하며, LDAP 및 NTLM도 지원 |
| 상호 관계 | AD와 같은 디렉터리 서비스에서 데이터를 추출하거나 조작할 때 사용하는 수단 | LDAP를 기본 프로토콜 중 하나로 채택하여 클라이언트 요청을 처리하는 데이터베이스 |