IntegrAuth Academy
Identity, security and practical AI — free, from zero. Byte-sized lessons, real diagrams, hands-on labs, zero fluff. Two programs, each with its own exam and certificate.
English is hard? Your browser can translate this page into Tamil, Telugu, Kannada, Malayalam or Hindi. Tech words stay in English so you learn the real names.
How?
- Chrome on phone: ⋮ menu → Translate
- Chrome on computer: right-click → Translate to …
- Edge: the translate icon in the address bar
Directories — LDAP, Active Directory and the cloud directory
Before an app can ask "who are you?", something must hold the answer. It is a list of every person, group and machine, with facts about each one. We call it a directory. Apps read it with LDAP. Your goal: read an LDAP search, and spot the mistakes that let attackers in.
- A directory is a tree of entries. Each entry has a full path called a DN.
- An app proves who it is with a bind, then reads with a search.
- Escape what a user types before it goes into a filter.
- In Active Directory, the forest is the security boundary, not the domain.
The staff register at a big company's reception. It lists every person with facts like name, department and phone, filed in sections: "Priya, People section, Example company". Visitors are checked against it. A directory is that register. LDAP is how apps ask it questions.
The tree and the DN
LDAP (Lightweight Directory Access Protocol) is the standard way to talk to a directory. OpenLDAP and Microsoft's Active Directory both speak it.
Entries sit in a tree called the Directory Information Tree (DIT). Each entry has a name called a distinguished name (DN). The DN is the full path from the entry up to the root. Priya's DN is uid=priya,ou=people,dc=example,dc=com.
Read it from right to left. dc is a domain part, so this is example.com. ou=people is an organizational unit, a container like a folder. uid=priya is the entry.
Facts about an entry are attributes, such as mail. Its object class, such as person, says which attributes it must or may have.
Bind, then search
A bind means "prove who you are on this connection." A simple bind sends a DN and a password. Many apps check a login by binding as the user with the typed password. If the bind works, the password was right.
One trap: a bind with a DN and an empty password is an unauthenticated bind. It proves nothing. Servers should refuse it by default (RFC 4513). Your app must refuse empty passwords too.
A simple bind on plain port 389 sends the password in clear text. Use TLS (LDAPS or StartTLS) before any bind. LDAP signing does not fix this, because it does not hide a simple bind.
A search reads the tree. It names a base DN (where to start), a scope (how deep to look) and a filter (which entries match).
Filters and escaping
A filter puts the operator first, inside brackets. (&(objectClass=person)(department=Sales)) means "a person AND in Sales". | is OR. ! is NOT. * is a wildcard. All parts of an & must be true.
Any value typed by a user must be escaped before it goes into a filter. Write each special character as a backslash plus two hex digits (RFC 4515). So * becomes \2a, ( becomes \28 and ) becomes \29. Without this step you allow LDAP injection. A login filter (uid=INPUT) becomes (uid=*) when a user types *. Now it matches every account.
Active Directory and the cloud directory
In most offices the directory is Microsoft's Active Directory (AD DS). It speaks LDAP and also handles Windows sign-in.
One AD fact matters most. Microsoft says the forest, not the domain, is the security boundary. An admin in one domain can reach data in another domain of the same forest. To keep two sets of admins apart, use separate forests.
Cloud identity providers keep their own directory. A common one is Microsoft Entra ID. Most companies run both and keep them in sync. Give each fact one source of authority (lifecycle lesson). Change it there, and sync carries it outward.
Go deeper: LDAP details and ports
LDAP is defined in RFC 4511. OpenLDAP and 389 Directory Server also speak it. Plain LDAP uses port 389. LDAP wrapped in TLS is called LDAPS. It uses port 636.
RFC 4513 covers how LDAP clients prove who they are and how the connection is protected. It warns against a simple bind without TLS.
Go deeper: Reading LDAP filters
LDAP filters (RFC 4515) put the operator first, then its parts, all inside brackets. The building blocks are small:
| Filter | Meaning |
|---|---|
(uid=priya) | Equal: the uid is priya. |
(cn=Pri*) | Starts with: the common name begins with Pri. |
(mail=*) | Present: the entry has a mail attribute. |
(&(objectClass=person)(department=Sales)) | AND: both parts must be true. |
(!(accountStatus=disabled)) | NOT: the account is not disabled. |
The special characters to escape are *, (, ), \ and NUL. For example, ( becomes \28.
Go deeper: Stopping LDAP injection
The OWASP LDAP Injection Prevention Cheat Sheet lists the defenses. Escape every untrusted value. Filters and DNs need different escaping. Check input against an allow-list of expected characters. Bind with a least-privilege account. Then a leaked query cannot read or change the whole tree.
Story: a partner app showed ex-employees as active. Its login search was just (uid=<whatever the user typed>), with no "not disabled" clause and no escaping. Zara added the clause and escaped the input.
Go deeper: Active Directory building blocks
Domain
A group of accounts that share one copy of the directory. Every domain controller (DC) in the domain holds a copy, and they are all peers.
Forest
One or more domains that share the same rules and settings. An admin in one domain can reach data in another domain of the same forest.
Organizational unit (OU)
A container inside a domain. You use it to group objects and hand out admin tasks. You also attach Group Policy to it. An OU is not a security group.
Domain controller (DC)
A server that runs the directory and answers sign-ins. AD is multi-master. Any DC can accept a change and copy it to the others.
AD has two kinds of group. A security group can appear in an access control list (ACL), so it can grant permissions. A distribution group is only an email list. Groups can sit inside other groups. That quietly causes privilege creep, as the access-reviews lesson warns.
Open tools use the same ideas: OpenLDAP, FreeIPA and Samba. FreeIPA bundles a directory, a Kerberos server and a certificate authority. Samba, since version 4.0, can act as an AD domain controller.
Go deeper: The cloud directory and hybrid sync
Microsoft Entra ID was called Azure Active Directory until 2023. A cloud directory is flat. You talk to it with web protocols such as OIDC and SAML.
A cloud directory has no OU tree and no Group Policy. This is on purpose. It is built for web and SaaS sign-in. On-site AD is built for Windows networks.
In the Microsoft world, one sync tool is Microsoft Entra Connect. Keycloak can instead read users straight from AD over LDAP.
When on-site AD owns a synced user, that user is read-only in the cloud. Edits there fail. If two systems both think they own one field, they overwrite each other's real data.
Go deeper: LDAP signing and channel binding
On port 389, an attacker in the middle can change unsigned LDAP messages. LDAP signing adds a cryptographic signature, so changes are detected. It protects integrity, not secrecy. It applies to non-TLS SASL sessions. It does not protect a simple bind, so use TLS for those.
Channel binding ties a sign-in to one specific TLS session. That blocks a relay of stolen credentials to another server. It is aimed mainly at NTLM relay.
As of October 2026, Microsoft says Windows Server 2025 requires LDAP signing by default on new Active Directory deployments. An upgrade keeps the policy you already had. Before you enforce signing, watch the Directory Service events 2887 and 2889. They show clients that still send unsigned requests. Source: Microsoft Learn, "LDAP signing overview for Active Directory".
The directory is the root of trust for provisioning, reviews and every login. Kerberos comes next.
🧪 Interactive lab — enable JavaScript to play with this one.
Run real LDAP filters on a public read-only test directory. Use Apache Directory Studio with the Online LDAP Test Server (host ldap.forumsys.com, base dc=example,dc=com). Try (uid=tesla).