L35
LDAP, directories and secure binds
Cram this first — memory hook
Lightweight Directory Access Protocol = ask the directory. Shelf 389 is the ordinary entrance; two six-shaped locks guard shelf 3 at 636.
Exam trap
Port 389 does not prove plaintext, because StartTLS may protect it. Port choice alone does not verify certificate validation or access rights.
The slide facts
accesses directory information organized by schema and distinguished names. Secure options include Simple Authentication and Security Layer and LDAP over TLS ; simple bind requires care.
If you have time — extra
Lightweight Directory Access Protocol () lets applications read and manage a directory: entries for users, groups, devices and other objects. A schema defines allowed object types and attributes. A Distinguished Name () uniquely locates an entry in its directory hierarchy, rather like a full office address. is commonly served on Transmission Control Protocol () 389. over Transport Layer Security (), commonly called , normally uses 636; StartTLS can upgrade a suitable connection on 389. A bind establishes authentication for the directory session. Simple bind can expose a password if the connection lacks appropriate protection. Simple Authentication and Security Layer () is a framework for authentication mechanisms, not a guarantee that every bind is encrypted. directory queries and Kerberos tickets do different jobs even when one organization uses both.
Walkthrough
Connect to the intended directory securely, authenticate as appropriate, issue a query for an entry or group, receive authorized attributes, and apply application policy based on trusted results.